Reason

no dangerous workflow patterns detected

Reason

no binaries found in the repo

Reason

15 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10

Reason

SAST tool is run on all commits

Details

• Info: all commits (20) are checked with a SAST tool

Reason

0 existing vulnerabilities detected

Reason

Found 7/17 approved changesets -- score normalized to 4

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/flowzone.yml:1
• Info: no jobLevel write permissions found

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: third-party GitHubAction not pinned by hash: .github/workflows/flowzone.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/balena-io-modules/odata-to-abstract-sql/flowzone.yml/master?enable=pin
• Info: 0 out of 1 third-party GitHubAction dependencies pinned

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

license file not detected

Details

• Warn: project does not have a license file

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

Project has not signed or included provenance with any releases.

Details

• Warn: release artifact v8.0.0 not signed: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/232696852
• Warn: release artifact v7.2.7 not signed: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/232689650
• Warn: release artifact v7.2.6 not signed: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/226510959
• Warn: release artifact v7.2.5 not signed: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/225907934
• Warn: release artifact v7.2.3 not signed: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/212768449
• Warn: release artifact v8.0.0 does not have provenance: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/232696852
• Warn: release artifact v7.2.7 does not have provenance: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/232689650
• Warn: release artifact v7.2.6 does not have provenance: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/226510959
• Warn: release artifact v7.2.5 does not have provenance: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/225907934
• Warn: release artifact v7.2.3 does not have provenance: https://api.github.com/repos/balena-io-modules/odata-to-abstract-sql/releases/212768449

Reason

branch protection not enabled on development/release branches

Details

• Warn: 'allow deletion' enabled on branch 'master'
• Warn: 'force pushes' enabled on branch 'master'
• Warn: 'branch protection settings apply to administrators' is disabled on branch 'master'
• Warn: 'stale review dismissal' is disabled on branch 'master'
• Warn: branch 'master' does not require approvers
• Warn: codeowners review is not required on branch 'master'
• Warn: 'last push approval' is disabled on branch 'master'
• Info: 'up-to-date branches' is required to merge on branch 'master'
• Info: status check found to merge onto on branch 'master'
• Info: PRs are required in order to make changes on branch 'master'