Reason

30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10

Reason

no dangerous workflow patterns detected

Reason

no binaries found in the repo

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Warn: project license file does not contain an FSF or OSI license.

Reason

3 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
• Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
• Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3

Reason

Found 0/20 approved changesets -- score normalized to 0

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/feature.yaml:1
• Warn: no topLevel permission defined: .github/workflows/main.yaml:1
• Info: no jobLevel write permissions found

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/feature.yaml:8: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/feature.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/feature.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/feature.yaml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/feature.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/feature.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/feature.yaml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/feature.yaml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/feature.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/feature.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:8: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yaml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yaml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:88: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yaml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yaml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/gajus/slonik/main.yaml/main?enable=pin
• Warn: containerImage not pinned by hash: packages/test-ssls/Dockerfile:1: pin your Docker image by updating postgres:16 to postgres:16@sha256:918e8e72b35b5370901965ce3da5a355c3537cb5e10c38e82c2b6f174b758334
• Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 7 third-party GitHubAction dependencies pinned
• Info: 0 out of 1 containerImage dependencies pinned

Reason

SAST tool is not run on all commits -- score normalized to 0

Details

• Warn: 0 commits out of 12 are checked with a SAST tool