Reason

25 commit(s) out of 30 and 0 issue activity out of 30 found in the last 90 days -- score normalized to 10

Reason

all last 30 commits are reviewed through GitHub

Reason

no vulnerabilities detected

Reason

update tool detected

Details

• Info: Renovabot detected: renovate.json:1

Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: : LICENSE:1

Reason

no binaries found in the repo

Reason

dependency not pinned by hash detected -- score normalized to 7

Details

• Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/release.yaml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=pin
• Warn: npmCommand not pinned by hash: .github/workflows/test.yml:34
• Warn: npmCommand not pinned by hash: .github/workflows/test.yml:47
• Warn: npmCommand not pinned by hash: .github/workflows/test.yml:18
• Info: Dockerfile dependencies are pinned
• Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles
• Info: no insecure (not pinned by hash) dependency downloads found in shell scripts

Reason

branch protection is not maximal on development and all release branches

Details

• Info: 'force pushes' disabled on branch 'master'
• Info: 'allow deletion' disabled on branch 'master'
• Warn: no status checks found to merge onto branch 'master'
• Warn: number of required reviewers is only 1 on branch 'master'
• Warn: branch protection not enabled for branch 'ProtoBuf5'

Reason

no badge detected

Reason

non read-only tokens detected in GitHub workflows

Details

• Warn: no topLevel permission defined: .github/workflows/release.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/release.yaml/master?enable=permissions
• Warn: no topLevel permission defined: .github/workflows/test.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/buggy1985/twitter-share-count/test.yml/master?enable=permissions

Reason

security policy file not detected

Reason

project is not fuzzed