See

https://bestpractices.coreinfrastructure.org/projects/357

The self-certification questionnaire should also be reviewed. MikeB filled it in, but guessed on a few things that seemed not applicable, but didn't have N/A as a choice.

Since they gave us 100% rating (despite fuzz testing issue below), I dropped their badge on our wiki front page, but removed it pending review by Steve Lawrence of the questionnaire answers.

Also JIRA DFDL-1602. The above self-certification questionnaire reminded me that we're not doing fuzz testing but clearly we should. They gave us 100% rating anyway, even though this fuzz testing requirement was listed as "not met", but this is also based on some guesses on my part about a few of the other questionnaire answers.