Reason

no dangerous workflow patterns detected

Reason

no binaries found in the repo

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Info: FSF or OSI recognized license: MIT License: LICENSE:0

Reason

Found 0/14 approved changesets -- score normalized to 0

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/nodejs.yml:1
• Info: no jobLevel write permissions found

Reason

project is archived

Details

• Warn: Repository is archived.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/feathersjs-ecosystem/schema/nodejs.yml/development?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/feathersjs-ecosystem/schema/nodejs.yml/development?enable=pin
• Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:21
• Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:22
• Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 2 npmCommand dependencies pinned

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'development'

Reason

SAST tool is not run on all commits -- score normalized to 0

Details

• Warn: 0 commits out of 20 are checked with a SAST tool

Reason

49 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
• Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
• Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
• Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
• Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
• Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
• Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
• Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
• Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
• Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
• Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
• Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
• Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
• Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
• Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
• Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
• Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
• Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
• Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
• Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
• Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
• Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
• Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
• Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
• Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
• Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
• Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
• Warn: Project is vulnerable to: GHSA-3j8f-xvm3-ffx4
• Warn: Project is vulnerable to: GHSA-4p35-cfcx-8653
• Warn: Project is vulnerable to: GHSA-7f3x-x4pr-wqhj
• Warn: Project is vulnerable to: GHSA-jpp7-7chh-cf67
• Warn: Project is vulnerable to: GHSA-q6wq-5p59-983w
• Warn: Project is vulnerable to: GHSA-j9fq-vwqv-2fm2
• Warn: Project is vulnerable to: GHSA-pqw5-jmp5-px4v
• Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
• Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
• Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
• Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
• Warn: Project is vulnerable to: GHSA-vx3p-948g-6vhq
• Warn: Project is vulnerable to: GHSA-3jfq-g458-7qm9
• Warn: Project is vulnerable to: GHSA-r628-mhmh-qjhw
• Warn: Project is vulnerable to: GHSA-9r2w-394v-53qc
• Warn: Project is vulnerable to: GHSA-5955-9wpr-37jh
• Warn: Project is vulnerable to: GHSA-qq89-hq3f-393p
• Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
• Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
• Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
• Warn: Project is vulnerable to: GHSA-38fc-wpqx-33j7
• Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh