Reason

all changesets reviewed

Reason

28 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10

Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0

Reason

security policy file detected

Details

• Info: security policy file detected: github.com/aws-amplify/.github/SECURITY.md:1
• Info: Found linked content: github.com/aws-amplify/.github/SECURITY.md:1
• Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/aws-amplify/.github/SECURITY.md:1
• Info: Found text in security policy: github.com/aws-amplify/.github/SECURITY.md:1

Reason

SAST tool is run on all commits

Details

• Info: SAST configuration detected: CodeQL
• Info: SAST configuration detected: CodeQL
• Info: all commits (30) are checked with a SAST tool

Reason

binaries present in source code

Details

• Warn: binary detected: packages/amplify-frontend-ios/resources/amplify-xcode:1

Reason

8 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
• Warn: Project is vulnerable to: GHSA-846g-p7hm-f54r
• Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
• Warn: Project is vulnerable to: GHSA-v4mq-x674-ff73
• Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
• Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
• Warn: Project is vulnerable to: GHSA-22r3-9w55-cj54
• Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-tests.yaml:14
• Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-tests.yaml:15
• Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yaml:15
• Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yaml:14
• Warn: no topLevel permission defined: .github/workflows/build-test-mac.yml:1
• Warn: no topLevel permission defined: .github/workflows/closed-issue-message.yml:1
• Warn: no topLevel permission defined: .github/workflows/codeql-tests.yaml:1
• Warn: no topLevel permission defined: .github/workflows/codeql.yaml:1
• Info: topLevel 'contents' permission set to 'read': .github/workflows/smoke-tests-canaries.yml:6
• Info: topLevel 'contents' permission set to 'read': .github/workflows/smoke-tests-manual.yml:6
• Info: topLevel 'contents' permission set to 'read': .github/workflows/smoke-tests.yml:6
• Info: no jobLevel write permissions found

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

Project has not signed or included provenance with any releases.

Details

• Warn: release artifact v12.14.1 not signed: https://api.github.com/repos/aws-amplify/amplify-cli/releases/195177952
• Warn: release artifact v12.14.0 not signed: https://api.github.com/repos/aws-amplify/amplify-cli/releases/192991276
• Warn: release artifact v12.13.1 not signed: https://api.github.com/repos/aws-amplify/amplify-cli/releases/186029380
• Warn: release artifact v12.13.0 not signed: https://api.github.com/repos/aws-amplify/amplify-cli/releases/178508647
• Warn: release artifact v12.12.6 not signed: https://api.github.com/repos/aws-amplify/amplify-cli/releases/168999461
• Warn: release artifact v12.14.1 does not have provenance: https://api.github.com/repos/aws-amplify/amplify-cli/releases/195177952
• Warn: release artifact v12.14.0 does not have provenance: https://api.github.com/repos/aws-amplify/amplify-cli/releases/192991276
• Warn: release artifact v12.13.1 does not have provenance: https://api.github.com/repos/aws-amplify/amplify-cli/releases/186029380
• Warn: release artifact v12.13.0 does not have provenance: https://api.github.com/repos/aws-amplify/amplify-cli/releases/178508647
• Warn: release artifact v12.12.6 does not have provenance: https://api.github.com/repos/aws-amplify/amplify-cli/releases/168999461

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: third-party GitHubAction not pinned by hash: .github/workflows/closed-issue-message.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/closed-issue-message.yml/dev?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-tests.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/codeql-tests.yaml/dev?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-tests.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/codeql-tests.yaml/dev?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-tests.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/codeql-tests.yaml/dev?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/codeql.yaml/dev?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/codeql.yaml/dev?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/codeql.yaml/dev?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-pending-response.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/aws-amplify/amplify-cli/issue-pending-response.yml/dev?enable=pin
• Warn: containerImage not pinned by hash: packages/amplify-container-hosting/resources/express-template/Dockerfile:1: pin your Docker image by updating public.ecr.aws/bitnami/node:14-prod-debian-10 to public.ecr.aws/bitnami/node:14-prod-debian-10@sha256:a494ad32bfa356b808d167e744ce69810401b4e8b38421f05d049af8ea01d457
• Warn: containerImage not pinned by hash: packages/amplify-container-hosting/resources/simple-template/Dockerfile:2
• Warn: containerImage not pinned by hash: packages/amplify-container-hosting/resources/simple-template/Dockerfile:9: pin your Docker image by updating public.ecr.aws/nginx/nginx:1 to public.ecr.aws/nginx/nginx:1@sha256:0802e3c4c7025bc4fc28d0215cca76c931db79243f51368d70988c1de0748402
• Warn: npmCommand not pinned by hash: packages/amplify-container-hosting/resources/express-template/Dockerfile:6
• Warn: npmCommand not pinned by hash: shared-scripts.sh:514
• Warn: npmCommand not pinned by hash: shared-scripts.sh:515
• Warn: npmCommand not pinned by hash: shared-scripts.sh:524
• Warn: npmCommand not pinned by hash: shared-scripts.sh:671
• Warn: npmCommand not pinned by hash: shared-scripts.sh:672
• Warn: downloadThenRun not pinned by hash: shared-scripts.sh:707
• Info: 5 out of 11 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 2 third-party GitHubAction dependencies pinned
• Info: 0 out of 3 containerImage dependencies pinned
• Info: 0 out of 6 npmCommand dependencies pinned
• Info: 0 out of 1 downloadThenRun dependencies pinned