Reason

no binaries found in the repo

Reason

all changesets reviewed

Reason

14 different organizations found -- score normalized to 10

Details

• Info: contributors work for EOSEssentials,MonsterEOS,TBD54566975,arquillian,jboss-eap,jbossejb3,jsfunit,openshiftio-private,shrinkwrap,square,squareup,tbd,tbd54566975,tbdeng

Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: License file found in expected location: LICENSE:1
• Info: FSF or OSI recognized license: LICENSE:1

Reason

SAST tool detected but not run on all commits

Details

• Warn: 22 commits out of 30 are checked with a SAST tool
• Info: SAST tool detected: CodeQL

Reason

22 out of 30 merged PRs checked by a CI test -- score normalized to 7

Reason

dependency not pinned by hash detected -- score normalized to 2

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/codeql.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/codeql.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/codeql.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/codeql.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-ci.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-ci.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-ci.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-ci.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-publish.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-publish.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-publish.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-publish.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-publish.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-publish.yml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/integrity-check.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/integrity-check.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/integrity-check.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/integrity-check.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integrity-check.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/integrity-check.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/release.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/release.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/tbdocs-commenter.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/tbdocs-commenter.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/tbdocs-commenter.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/tbdocs-commenter.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/tbdocs-commenter.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/tbdocs-commenter.yml/main?enable=pin
• Info: 10 out of 19 GitHub-owned GitHubAction dependencies pinned
• Info: 3 out of 14 third-party GitHubAction dependencies pinned

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

no update tool detected

Details

• Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)
• Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)
• Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)
• Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)

Reason

project is not fuzzed

Details

• Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
• Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
• Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
• Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
• Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
• Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)

Reason

0 commit(s) out of 30 and 0 issue activity out of 30 found in the last 90 days -- score normalized to 0

Reason

security policy file not detected

Details

• Warn: no security policy file detected: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. For additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)
• Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Provide a point of contact in your SECURITY.md. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
• Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
• Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/codeql.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/codeql.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:37
• Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:38
• Warn: no topLevel permission defined: .github/workflows/docs-ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-ci.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Warn: no topLevel permission defined: .github/workflows/docs-publish.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/docs-publish.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Warn: jobLevel 'contents' permission set to 'write': .github/workflows/docs-publish.yml:19: Verify which permissions are needed and consider whether you can reduce them. (High effort)
• Info: jobLevel 'contents' permission set to 'read': .github/workflows/docs-publish.yml:76
• Warn: no topLevel permission defined: .github/workflows/integrity-check.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/integrity-check.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Info: topLevel 'contents' permission set to 'read': .github/workflows/release-snapshot.yml:14
• Warn: no topLevel permission defined: .github/workflows/release.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/release.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:18: Verify which permissions are needed and consider whether you can reduce them. (High effort)
• Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18
• Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/scorecard.yml:25: Verify which permissions are needed and consider whether you can reduce them. (High effort)
• Warn: no topLevel permission defined: .github/workflows/security.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/security.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Warn: no topLevel permission defined: .github/workflows/tbdocs-commenter.yml:1: Visit https://app.stepsecurity.io/secureworkflow/TBD54566975/tbdex-js/tbdocs-commenter.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)