Reason

no binaries found in the repo

Reason

no dangerous workflow patterns detected

Reason

8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6

Reason

dependency not pinned by hash detected -- score normalized to 3

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:124: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:132: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/build.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/build.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/publish.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/publish.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/equalogic/vue-apollo-smart-ops/publish.yml/master?enable=pin
• Info: 0 out of 16 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 1 third-party GitHubAction dependencies pinned
• Info: 2 out of 2 npmCommand dependencies pinned

Reason

Found 0/30 approved changesets -- score normalized to 0

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/build.yml:1
• Warn: no topLevel permission defined: .github/workflows/publish.yml:1
• Info: no jobLevel write permissions found

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

license file not detected

Details

• Warn: project does not have a license file

Reason

SAST tool is not run on all commits -- score normalized to 0

Details

• Warn: 0 commits out of 30 are checked with a SAST tool

Reason

12 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
• Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
• Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
• Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
• Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
• Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
• Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
• Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
• Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
• Warn: Project is vulnerable to: GHSA-5j4c-8p2g-v4jx
• Warn: Project is vulnerable to: GHSA-g3ch-rx76-35fx
• Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q