Gathering detailed insights and metrics for @twilio-labs/plugin-flex
Gathering detailed insights and metrics for @twilio-labs/plugin-flex
Packages related to building a Twilio Flex Plugin
Installations
npm install @twilio-labs/plugin-flexDeveloper Guide
BETA
Typescript
No
Module System
N/A
Min. Node Version
^16 || ^18 || ^20 || ^22
Node Version
22.16.0
NPM Version
lerna/5.6.2/node@v22.16.0+x64 (linux)
Releases
3
Languages
5
TypeScript
JavaScript
Shell
HTML
CSS
TypeScript (97.66%)
JavaScript (1.87%)
Shell (0.38%)
HTML (0.08%)
CSS (0.02%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
85 Stars
3,306 Commits
56 Forks
17 Watchers
127 Branches
49 Contributors
Updated on Jul 07, 2025
Maintainers
2
Package Meta Information
Latest Version
7.1.2
Package Id
@twilio-labs/plugin-flex@7.1.2
Unpacked Size
388.61 kB
Size
70.05 kB
File Count
121
NPM Version
lerna/5.6.2/node@v22.16.0+x64 (linux)
Node Version
22.16.0
Published on
Jun 12, 2025
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
15
@twilio-labs/plugin-flex
Twilio CLI plugin to interact with the Flex Plugin Builder
This plugin adds functionality to the Twilio CLI to locally develop, build and deploy Twilio Flex plugins; it uses the Flex Plugin Builder.
Requirements
Install the Twilio CLI
Via npm or yarn:
1$ npm install -g twilio-cli 2$ yarn global add twilio-cli
Via homebrew:
1$ brew tap twilio/brew && brew install twilio
Usage
1$ twilio plugins:install @twilio-labs/plugin-flex 2 3$ twilio --help flex 4 5USAGE 6 $ twilio flex 7...
Commands
twilio flex:plugins:archive:configurationtwilio flex:plugins:archive:plugintwilio flex:plugins:archive:plugin-versiontwilio flex:plugins:buildtwilio flex:plugins:create NAMEtwilio flex:plugins:create-configurationtwilio flex:plugins:deploytwilio flex:plugins:describe:configurationtwilio flex:plugins:describe:plugintwilio flex:plugins:describe:plugin-versiontwilio flex:plugins:describe:releasetwilio flex:plugins:diff ID1 [ID2]twilio flex:plugins:list:configurationstwilio flex:plugins:list:plugin-versionstwilio flex:plugins:list:pluginstwilio flex:plugins:list:releasestwilio flex:plugins:releasetwilio flex:plugins:starttwilio flex:plugins:testtwilio flex:plugins:upgrade-plugintwilio flex:plugins:validate
twilio flex:plugins:archive:configuration
Archives a Flex Plugin Configuration. Archived Plugin Configurations cannot be deployed to your Flex application and cannot be undone. Exercise extreme caution when using this command.
USAGE
$ twilio flex:plugins:archive:configuration
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--sid=sid (required) The Flex Plugin Configuration SID to archive.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/archive/configuration.js
twilio flex:plugins:archive:plugin
Archives a Flex Plugin. Archived Plugins cannot be enabled on your Flex application and cannot be undone. Exercise extreme caution when using this command.
USAGE
$ twilio flex:plugins:archive:plugin
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--name=name (required) The name of the Flex Plugin to archive.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/archive/plugin.js
twilio flex:plugins:archive:plugin-version
Archives a Flex Plugin Version. Archived Plugin Versions cannot be enabled on your Flex application and cannot be undone. Exercise extreme caution when using this command.
USAGE
$ twilio flex:plugins:archive:plugin-version
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--name=name (required) The Flex Plugin name of the Plugin Version to archive.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
--version=version (required) The Flex Plugin Version to archive.
See code: dist/commands/flex/plugins/archive/plugin-version.js
twilio flex:plugins:build
Builds the Flex plugin and creates a JavaScript and sourcemap bundle. This command needs to be invoked inside a plugin directory.
USAGE
$ twilio flex:plugins:build
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/build.js
twilio flex:plugins:create NAME
Creates a new Twilio Flex Plugin project
USAGE
$ twilio flex:plugins:create NAME
ARGUMENTS
NAME Creates a new Twilio Flex Plugin project
Arguments:
name Name of your plugin.
OPTIONS
-a, --accountSid=accountSid The Account SID for your Flex Project
-h, --help=help
-i, --install Auto-install dependencies
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
-r, --runtimeUrl The URL to your Twilio Flex Runtime
-s, --typescript Create a TypeScript project
-t, --template=template A GitHub URL that contains your template
-v, --version=version
-y, --yarn Use yarn as your dependency manager
--flexui1 Creates a plugin compatible with Flex UI major version 1.0
--flexui2 Creates a plugin compatible with Flex UI major version 2.0
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
DESCRIPTION
Arguments:
name Name of your plugin. This command needs to be invoked inside a plugin directory.
See code: dist/commands/flex/plugins/create.js
twilio flex:plugins:create-configuration
Creates a Flex Plugin Configuration. This command needs to be invoked inside a plugin directory.
USAGE
$ twilio flex:plugins:create-configuration
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--description=description (required) [default: The description of this Flex Plugin Configuration.] The
description of this Flex Plugin Configuration.
--disable-plugin=disable-plugin The plugin to disable, formatted as pluginName. Use additional --disable-plugin to
provide other plugins to disable.
--enable-plugin=enable-plugin The plugin to enable, formatted as pluginName@version. You may use pluginName@latest
as a shortcut for enabling the latest version of the plugin. Use additional
--enable-plugin to provide other plugins to enable.
--json Outputs the result of the command as json string.
--name=name (required) [default: Autogenerated Release 1749720910720] The friendly name of the
Flex Plugin Configuration.
--new Creates a new Flex Plugin Configuration, otherwise will append to existing active
Configuration.
--plugin=plugin Alias for --enable-plugin.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/create-configuration.js
twilio flex:plugins:deploy
Builds and deploys a new version of the Flex plugin to your Flex application. This command needs to be invoked inside a plugin directory.
USAGE
$ twilio flex:plugins:deploy
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--bypass-validation Validates the plugin and continues to plugin deployment ignoring validation issues,
if any.
--changelog=changelog (required) The changes (added/removed) made in this plugin version.
--clear-terminal Clears the terminal before running the command.
--description=description The description of this Flex plugin.
--json Outputs the result of the command as json string.
--major Publishes the version as a major (SemVer).
--minor Publishes the version as a minor (SemVer).
--patch Publishes the version as a patch (SemVer); this is the default.
--public Publishes the plugin as a public Twilio Asset; default is private.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
--version=version Publishes the version (SemVer).
See code: dist/commands/flex/plugins/deploy.js
twilio flex:plugins:describe:configuration
Provides details of the Flex Plugin Configuration like status, description and its associated Plugins.
USAGE
$ twilio flex:plugins:describe:configuration
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--sid=sid (required) The Flex Plugin Configuration SID.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/describe/configuration.js
twilio flex:plugins:describe:plugin
Provides details of the Flex Plugin like status, description and its Flex Plugin Versions.
USAGE
$ twilio flex:plugins:describe:plugin
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--name=name (required) The name of the Flex Plugin to describe.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/describe/plugin.js
twilio flex:plugins:describe:plugin-version
Provides details of the Flex Plugin Version like changelog, status and the url of the plugin package.
USAGE
$ twilio flex:plugins:describe:plugin-version
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--name=name (required) The Flex Plugin name of the Plugin Version to describe.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
--version=version (required) The Flex Plugin Version to describe.
See code: dist/commands/flex/plugins/describe/plugin-version.js
twilio flex:plugins:describe:release
Provides details of the Flex Plugin Release like the underlying Plugin Configuration and Plugins.
USAGE
$ twilio flex:plugins:describe:release
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--active The most recent release to describe.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--sid=sid The Flex Plugin Release SID to describe.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/describe/release.js
twilio flex:plugins:diff ID1 [ID2]
Finds the diff between two Flex Plugin Configurations.
USAGE
$ twilio flex:plugins:diff ID1 [ID2]
ARGUMENTS
ID1 The first Flex Plugin Configuration SID.
ID2 The second Flex Plugin Configuration SID.
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/diff.js
twilio flex:plugins:list:configurations
Lists the Flex Plugin Configuration on the account.
USAGE
$ twilio flex:plugins:list:configurations
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/list/configurations.js
twilio flex:plugins:list:plugin-versions
Lists the Flex Plugin Versions on the account.
USAGE
$ twilio flex:plugins:list:plugin-versions
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--name=name (required) The plugin name to list its versions.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/list/plugin-versions.js
twilio flex:plugins:list:plugins
Lists the Flex Plugins on the account.
USAGE
$ twilio flex:plugins:list:plugins
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/list/plugins.js
twilio flex:plugins:list:releases
Lists the Flex Releases on the account.
USAGE
$ twilio flex:plugins:list:releases
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/list/releases.js
twilio flex:plugins:release
Creates a Flex Plugin Release. Enables the plugins (passed as params or via the Flex Configuration) on your Flex application.
USAGE
$ twilio flex:plugins:release
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--configuration-sid=configuration-sid The Flex Plugin Configuration SID to release; other options are not required
when using this option.
--description=description [default: The description of this Flex Plugin Configuration.] The description
of this Flex Plugin Configuration.
--disable-plugin=disable-plugin The plugin to disable, formatted as pluginName. Use additional --disable-plugin
to provide other plugins to disable.
--enable-plugin=enable-plugin The plugin to enable, formatted as pluginName@version. You may use
pluginName@latest as a shortcut for enabling the latest version of the plugin.
Use additional --enable-plugin to provide other plugins to enable.
--json Outputs the result of the command as json string.
--name=name [default: Autogenerated Release 1749720910720] The friendly name of the Flex
Plugin Configuration.
--new Creates a new Flex Plugin Configuration, otherwise will append to existing
active Configuration.
--plugin=plugin Alias for --enable-plugin.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/release.js
twilio flex:plugins:start
Starts a dev-server to build the Flex plugin locally.
USAGE
$ twilio flex:plugins:start
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--include-remote Use this flag to include all remote plugins in your build.
--json Outputs the result of the command as json string.
--name=name The name of the plugin you would like to run. You can provide multiple to run them
all concurrently. You can include specific active remote plugins using "--name
'plugin-name@remote'" or "--name 'plugin-name@0.0.0'" for a specific remote version.
--port=port [default: 3000] The port to start your local development server on.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/start.js
twilio flex:plugins:test
Runs the test suite. This command needs to be invoked inside a plugin directory.
USAGE
$ twilio flex:plugins:test
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/test.js
twilio flex:plugins:upgrade-plugin
Upgrades your plugin to use the latest version of the Plugin CLI.
USAGE
$ twilio flex:plugins:upgrade-plugin
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--beta If set, will upgrade to the latest beta version.
--clear-terminal Clears the terminal before running the command.
--dev If set, will upgrade to the latest dev version.
--flex-ui-2.0 Update your plugin dependencies to be compatible with Flex UI 2.0.
--install If set, will install the dependencies.
--json Outputs the result of the command as json string.
--nightly If set, will upgrade to the latest nightly version.
--remove-legacy-plugin Deletes legacy plugin bundle hosted on Twilio Assets (deployed via plugin builder
v3).
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
--yarn Use yarn for installation.
--yes If set, will answer yes to all prompts.
See code: dist/commands/flex/plugins/upgrade-plugin.js
twilio flex:plugins:validate
Validates the Flex plugin by looking for any issues that could potentially break the plugin when in use. Generates a report with the identified issues, if any.
USAGE
$ twilio flex:plugins:validate
OPTIONS
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-o=(columns|json|tsv|none) [default: columns] Format of command output.
-p, --profile=profile Shorthand identifier for your profile.
--clear-terminal Clears the terminal before running the command.
--flex-ui-2.0 Validates the Flex plugin for compatibility with the latest Flex UI 2.x version.
--json Outputs the result of the command as json string.
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
See code: dist/commands/flex/plugins/validate.js
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no binaries found in the repo
Reason
Found 5/8 approved changesets -- score normalized to 6
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/e2e_scheduled.yaml:1
- Warn: no topLevel permission defined: .github/workflows/e2e_scheduled_jailbreak.yaml:1
- Warn: no topLevel permission defined: .github/workflows/manual_alpha_release_v6.yaml:1
- Warn: no topLevel permission defined: .github/workflows/manual_public_release.yaml:1
- Warn: no topLevel permission defined: .github/workflows/manual_public_release_v6.yaml:1
- Warn: no topLevel permission defined: .github/workflows/pr_e2e.yaml:1
- Warn: no topLevel permission defined: .github/workflows/pr_workflow.yaml:1
- Warn: no topLevel permission defined: .github/workflows/skip_e2e.yaml:1
- Warn: no topLevel permission defined: .github/workflows/skip_pr_workflow.yaml:1
- Warn: no topLevel permission defined: .github/workflows/skip_publish.yaml:1
- Warn: no topLevel permission defined: .github/workflows/tag.yaml:1
- Warn: no topLevel permission defined: .github/workflows/~reusable_e2e_all_OS.yaml:1
- Warn: no topLevel permission defined: .github/workflows/~reusable_e2e_by_OS.yaml:1
- Warn: no topLevel permission defined: .github/workflows/~reusable_public_publish.yaml:1
- Warn: no topLevel permission defined: .github/workflows/~reusable_publish.yaml:1
- Info: no jobLevel write permissions found
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr_e2e.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/pr_e2e.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr_e2e.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/pr_e2e.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr_e2e.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/pr_e2e.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr_workflow.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/pr_workflow.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pr_workflow.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/pr_workflow.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr_workflow.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/pr_workflow.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tag.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/tag.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_e2e_by_OS.yaml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_e2e_by_OS.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_e2e_by_OS.yaml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_e2e_by_OS.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_e2e_by_OS.yaml:171: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_e2e_by_OS.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/~reusable_e2e_by_OS.yaml:183: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_e2e_by_OS.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/~reusable_public_publish.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_public_publish.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_public_publish.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_public_publish.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_public_publish.yaml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_public_publish.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/~reusable_public_publish.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_public_publish.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/~reusable_public_publish.yaml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_public_publish.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_publish.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_publish.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/~reusable_publish.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_publish.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/~reusable_publish.yaml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/twilio/flex-plugin-builder/~reusable_publish.yaml/main?enable=pin
- Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 7 third-party GitHubAction dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
59 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-73rg-f94j-xvhx
- Warn: Project is vulnerable to: GHSA-4882-hxpr-hrvm
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-x9w5-v3q2-3rhw
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-gx9m-whjm-85jf
- Warn: Project is vulnerable to: GHSA-mmhx-hmjr-r674
- Warn: Project is vulnerable to: GHSA-vhxf-7vqr-mrjg
- Warn: Project is vulnerable to: GHSA-f6v4-cf5j-vf3w
- Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
- Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
- Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
- Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
- Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
- Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
- Warn: Project is vulnerable to: GHSA-vjh7-7g9h-fjfh
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh
- Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-8cf7-32gw-wr33
- Warn: Project is vulnerable to: GHSA-hjrf-2m68-5959
- Warn: Project is vulnerable to: GHSA-qwph-4952-7xr6
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-h7cp-r72f-jxh6
- Warn: Project is vulnerable to: GHSA-v62p-rq8g-8h59
- Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg
- Warn: Project is vulnerable to: GHSA-p495-jxh2-wrfg
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
4.4
/10
Last Scanned on 2025-06-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More