web3privacy/Web3privacynowplatform/Scoringmodel.md

**Privacy scoring options to consider**

**Note**: _final scoring model shouldn't be too complex to execute._

_Sketches what could be put inside privacy-solutions scoring model_ (note: think of these as questions to experts for workshop on scoring ideation).

**Open-source transparency**
- **GitHub repos**: # of commits, # stars, date of repo creation.

**Third party validation**
- **Security audits**: yes, no; type of audit; ammount of audits.

**Community validation**
- Existing bugs
- White hackers assesment (like Secret Network TEE bug)
- Negative Discord, Twitter, other public feedback (product & founder-centric)

**Team**
- Market validation
- GitHub contribution
- Track record (incl. red flag projects)

**Financials**
- Investments
- TVL (like Aztec's L2)
- Donation-based
- Public treasury

**Liveliness**
- How active is GitHub activity 
- How active is community
- Is there a public product traction?

**Product-readiness**
- State of product-readiness
- MVP-readiness
- Protocol (test-net/main-net)
- dApp (release timing, third party validation like AppStore/Play Store)
- network-reliability (the state of privacy in Ethereum, Solana, Avalanche etc)

**Cross-checked data leakage**
- Complementing privacy stack data leakage (example: phone + dApp; wallet + RPC etc)
- Third party data leakage (from the hackers to state agents (think of Iran or North Korea govs))

**Data aggregation policies**

_Reference_: https://tosdr.org 

**Centralisation level (incl KYC)**

Reference: https://kycnot.me/about#scores

**On-going community research (survey) within the privacy experts - all answers on how to score services privacy (non-redacted)**:

**Docs**
- read the documentation
- Good and comprehensive documentation

- ask about its weaknesses from competitors
- try to trace a transaction
- Precise description of the concrete privacy properties. Privacy is complicated so if they don't say exactly what they protect, then its likely vapor
- Usability - for end users or in the developer experience if it is a B2B project.
- Validation by trusted and respected independent scientists and researchers
- Open source
- There is a way to verify the code I think is running, really is running e.g. attestation service
- Ability to run part of the service and verify for myself
- Other tooling to verify e.g. block explorers 
- Open source/FOSS
- Minimal to no metadata capture
- Doesn’t sell your data
- Non-vague, and non-intrusive privacy policy
- protects against global passive adversary
- does not implement kyc or aml
- strong secure anonymity tech
- Decentralized 
- Credibly neutral
- Usage of ZKP

**VCs**
- Who are the VCs
- not funded by big US VCs like a16z

**Team**
- ideological team
- Reputation of team