Reason

7 different organizations found -- score normalized to 10

Details

• Info: contributors work for IstanbulJUG,RakunMe,Trendyol,dracula,ieee-computer-society,mavidurak,trendyol

Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: License file found in expected location: LICENSE.md:1
• Info: FSF or OSI recognized license: LICENSE.md:1

Reason

30 commit(s) out of 30 and 3 issue activity out of 30 found in the last 90 days -- score normalized to 10

Reason

binaries present in source code

Details

• Warn: binary detected: android/gradle/wrapper/gradle-wrapper.jar:1

Reason

dependency not pinned by hash detected -- score normalized to 6

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docs.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/publish-docs.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docs.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/publish-docs.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docs.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/publish-docs.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docs.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/publish-docs.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-docs.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/publish-docs.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/release.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/release.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/release.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecard.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/scorecard.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/verify.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/verify.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/verify.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/verify.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/verify.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/verify.yml/main?enable=pin
• Info: 2 out of 14 GitHub-owned GitHubAction dependencies pinned
• Info: 1 out of 1 third-party GitHubAction dependencies pinned
• Info: 3 out of 3 npmCommand dependencies pinned

Reason

found 20 unreviewed changesets out of 23 -- score normalized to 1

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'main'
• Warn: branch protection not enabled for branch 'next'

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

no update tool detected

Details

• Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)
• Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)
• Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)
• Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)

Reason

project is not fuzzed

Details

• Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
• Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
• Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
• Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
• Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
• Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
• Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)

Reason

security policy file not detected

Details

• Warn: no security policy file detected: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. For additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)
• Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Provide a point of contact in your SECURITY.md. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
• Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
• Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Info: topLevel 'contents' permission set to 'read': .github/workflows/publish-docs.yml:8
• Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/pull-request.yml:9
• Warn: no topLevel permission defined: .github/workflows/release.yml:1: Visit https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/release.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:13
• Warn: jobLevel 'actions' permission set to 'write': .github/workflows/scorecard.yml:37: Verify which permissions are needed and consider whether you can reduce them. (High effort)
• Warn: no topLevel permission defined: .github/workflows/security-gates.yml:1: Visit https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/security-gates.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Info: jobLevel 'actions' permission set to 'read': .github/workflows/security-gates.yml:19
• Info: jobLevel 'contents' permission set to 'read': .github/workflows/security-gates.yml:20
• Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/security-gates.yml:21: Verify which permissions are needed and consider whether you can reduce them. (High effort)
• Warn: no topLevel permission defined: .github/workflows/verify-and-release.yml:1: Visit https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/verify-and-release.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
• Warn: no topLevel permission defined: .github/workflows/verify.yml:1: Visit https://app.stepsecurity.io/secureworkflow/Trendyol/baklava-react-native/verify.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)

Reason

18 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-cr5q-6q9f-rq6q
• Warn: Project is vulnerable to: GHSA-j6gc-792m-qgm2
• Warn: Project is vulnerable to: GHSA-pj73-v5mw-pm9j
• Warn: Project is vulnerable to: GHSA-7627-mp87-jf6q
• Warn: Project is vulnerable to: GHSA-g397-v4w5-4m79
• Warn: Project is vulnerable to: GHSA-2rxp-v6pw-ch6m
• Warn: Project is vulnerable to: GHSA-4xqq-m2hx-25v8
• Warn: Project is vulnerable to: GHSA-5866-49gr-22v4
• Warn: Project is vulnerable to: GHSA-r55c-59qm-vjw6
• Warn: Project is vulnerable to: GHSA-vg3r-rm7w-2xgh
• Warn: Project is vulnerable to: GHSA-vmwr-mc7x-5vc3
• Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
• Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
• Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
• Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
• Warn: Project is vulnerable to: GHSA-w5p7-h5w8-2hfq
• Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
• Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6