Reason

security policy file detected

Details

• Info: security policy file detected: SECURITY.md:1
• Info: Found linked content: SECURITY.md:1
• Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
• Info: Found text in security policy: SECURITY.md:1

Reason

no dangerous workflow patterns detected

Reason

30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Info: FSF or OSI recognized license: MIT License: LICENSE:0

Reason

no binaries found in the repo

Reason

SAST tool detected but not run on all commits

Details

• Info: SAST configuration detected: CodeQL
• Warn: 14 commits out of 16 are checked with a SAST tool

Reason

2 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
• Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp

Reason

Found 2/21 approved changesets -- score normalized to 0

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:23
• Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:24
• Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
• Warn: no topLevel permission defined: .github/workflows/main.yml:1
• Info: no jobLevel write permissions found

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/codeql-analysis.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/codeql-analysis.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/codeql-analysis.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:115: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/SBoudrias/Inquirer.js/main.yml/main?enable=pin
• Info: 0 out of 20 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 1 third-party GitHubAction dependencies pinned