Reason

no binaries found in the repo

Reason

13 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10

Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Info: FSF or OSI recognized license: MIT License: LICENSE:0

Reason

0 existing vulnerabilities detected

Reason

SAST tool is not run on all commits -- score normalized to 4

Details

• Warn: 10 commits out of 21 are checked with a SAST tool

Reason

dependency not pinned by hash detected -- score normalized to 3

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/self-hosted-test.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/kukhariev/node-uploadx/self-hosted-test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/self-hosted-test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/kukhariev/node-uploadx/self-hosted-test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/self-hosted-test.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/kukhariev/node-uploadx/self-hosted-test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/self-hosted-test.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/kukhariev/node-uploadx/self-hosted-test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/kukhariev/node-uploadx/test.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/kukhariev/node-uploadx/test.yml/master?enable=pin
• Info: 0 out of 6 GitHub-owned GitHubAction dependencies pinned
• Info: 3 out of 3 npmCommand dependencies pinned

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/self-hosted-test.yml:1
• Warn: no topLevel permission defined: .github/workflows/test.yml:1
• Info: no jobLevel write permissions found

Reason

Found 0/26 approved changesets -- score normalized to 0

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'master'