Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Info: FSF or OSI recognized license: MIT License: LICENSE:0

Reason

no binaries found in the repo

Reason

0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/release.yml:1
• Warn: no topLevel permission defined: .github/workflows/test.yml:1
• Info: no jobLevel write permissions found

Reason

Found 0/30 approved changesets -- score normalized to 0

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

no SAST tool detected

Details

• Warn: no pull requests merged into dev branch

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'main'

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/wetix/responsive-ui/release.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/wetix/responsive-ui/test.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/wetix/responsive-ui/test.yml/main?enable=pin
• Warn: npmCommand not pinned by hash: .github/workflows/release.yml:25
• Warn: npmCommand not pinned by hash: .github/workflows/test.yml:45
• Info: 0 out of 3 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 2 npmCommand dependencies pinned

Reason

63 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
• Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
• Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
• Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
• Warn: Project is vulnerable to: GHSA-x9w5-v3q2-3rhw
• Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
• Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
• Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
• Warn: Project is vulnerable to: GHSA-653v-rqx9-j85p
• Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
• Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
• Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
• Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
• Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
• Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
• Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
• Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
• Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
• Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
• Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
• Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq
• Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488
• Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g
• Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
• Warn: Project is vulnerable to: GHSA-4wx3-54gh-9fr9
• Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
• Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
• Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
• Warn: Project is vulnerable to: GHSA-3j8f-xvm3-ffx4
• Warn: Project is vulnerable to: GHSA-4p35-cfcx-8653
• Warn: Project is vulnerable to: GHSA-7f3x-x4pr-wqhj
• Warn: Project is vulnerable to: GHSA-jpp7-7chh-cf67
• Warn: Project is vulnerable to: GHSA-q6wq-5p59-983w
• Warn: Project is vulnerable to: GHSA-j9fq-vwqv-2fm2
• Warn: Project is vulnerable to: GHSA-pqw5-jmp5-px4v
• Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
• Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
• Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
• Warn: Project is vulnerable to: GHSA-3949-f494-cm99
• Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
• Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
• Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
• Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
• Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
• Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
• Warn: Project is vulnerable to: GHSA-w5hq-hm5m-4548
• Warn: Project is vulnerable to: GHSA-wv8q-r932-8hc7
• Warn: Project is vulnerable to: GHSA-8266-84wp-wv5c
• Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
• Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
• Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
• Warn: Project is vulnerable to: GHSA-w5p7-h5w8-2hfq
• Warn: Project is vulnerable to: GHSA-mv48-hcvh-8jj8
• Warn: Project is vulnerable to: GHSA-353f-5xf4-qw67
• Warn: Project is vulnerable to: GHSA-c24v-8rfc-w8vw
• Warn: Project is vulnerable to: GHSA-8jhw-289h-jh2g
• Warn: Project is vulnerable to: GHSA-4vvj-4cpr-p986 / GHSA-64vr-g452-qvp3
• Warn: Project is vulnerable to: GHSA-9cwx-2883-4wfx
• Warn: Project is vulnerable to: GHSA-vg6x-rcgg-rjx6
• Warn: Project is vulnerable to: GHSA-hc6q-2mpp-qw7j
• Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
• Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
• Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q