Reason

no dangerous workflow patterns detected

Reason

no binaries found in the repo

Reason

security policy file detected

Details

• Info: security policy file detected: github.com/commercelayer/.github/SECURITY.md:1
• Info: Found linked content: github.com/commercelayer/.github/SECURITY.md:1
• Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/commercelayer/.github/SECURITY.md:1
• Info: Found text in security policy: github.com/commercelayer/.github/SECURITY.md:1

Reason

project is archived

Details

• Warn: Repository is archived.

Reason

Found 1/29 approved changesets -- score normalized to 0

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/main.yml:1
• Info: no jobLevel write permissions found

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/commercelayer/commercelayer-js-sdk/main.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/commercelayer/commercelayer-js-sdk/main.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/commercelayer/commercelayer-js-sdk/main.yml/master?enable=pin
• Info: 0 out of 3 GitHub-owned GitHubAction dependencies pinned

Reason

license file not detected

Details

• Warn: project does not have a license file

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'master'

Reason

SAST tool is not run on all commits -- score normalized to 0

Details

• Warn: 0 commits out of 5 are checked with a SAST tool

Reason

60 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
• Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
• Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
• Warn: Project is vulnerable to: GHSA-cph5-m8f7-6c5x
• Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
• Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
• Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
• Warn: Project is vulnerable to: GHSA-x9w5-v3q2-3rhw
• Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
• Warn: Project is vulnerable to: GHSA-q8pj-2vqx-8ggc
• Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
• Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
• Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
• Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
• Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
• Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
• Warn: Project is vulnerable to: GHSA-vjh7-7g9h-fjfh
• Warn: Project is vulnerable to: GHSA-74fj-2j2h-c42q
• Warn: Project is vulnerable to: GHSA-pw2r-vq6v-hr8c
• Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
• Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
• Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
• Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
• Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
• Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq
• Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488
• Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g
• Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
• Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
• Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
• Warn: Project is vulnerable to: GHSA-qrpm-p2h7-hrv2
• Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
• Warn: Project is vulnerable to: GHSA-vxf5-wxwp-m7g9
• Warn: Project is vulnerable to: GHSA-9gr3-7897-pp7m
• Warn: Project is vulnerable to: GHSA-25mp-g6fv-mqxx
• Warn: Project is vulnerable to: GHSA-fmvm-x8mv-47mj
• Warn: Project is vulnerable to: GHSA-c59h-r6p8-q9wc
• Warn: Project is vulnerable to: GHSA-g77x-44xx-532m
• Warn: Project is vulnerable to: GHSA-7gfc-8cq8-jh5f
• Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
• Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
• Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
• Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
• Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
• Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
• Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
• Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
• Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
• Warn: Project is vulnerable to: GHSA-g4rg-993r-mgx7
• Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6
• Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj
• Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
• Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
• Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
• Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
• Warn: Project is vulnerable to: GHSA-hc6q-2mpp-qw7j
• Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986
• Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
• Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
• Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q