Gathering detailed insights and metrics for bootstrap
Gathering detailed insights and metrics for bootstrap
The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.
Installations
npm install bootstrapDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Node Version
20.14.0
NPM Version
10.2.4
Score
98.9
Supply Chain
100
Quality
87.2
Maintenance
100
Vulnerability
100
License
Releases
93
Languages
9
MDX
JavaScript
Astro
SCSS
CSS
HTML
TypeScript
Shell
PowerShell
MDX (28.87%)
JavaScript (25.73%)
Astro (19.36%)
SCSS (11.16%)
CSS (8.83%)
HTML (4.6%)
TypeScript (1.29%)
Shell (0.13%)
PowerShell (0.03%)
Developer
Download Statistics
Total Downloads
1,277,153,322
Last Day
206,337
Last Week
4,451,885
Last Month
19,661,559
Last Year
229,754,416
GitHub Statistics
MIT License
172,506 Stars
23,068 Commits
79,113 Forks
6,698 Watchers
112 Branches
1,397 Contributors
Updated on Jul 10, 2025
Sponsor this package
Maintainers
3
Package Meta Information
Latest Version
5.3.7
Package Id
bootstrap@5.3.7
Unpacked Size
9.17 MB
Size
1.60 MB
File Count
219
NPM Version
10.2.4
Node Version
20.14.0
Published on
Jun 17, 2025
Total Downloads
Cumulative downloads
Total Downloads
1,277,153,322
Last Day
-7.7%
206,337
Compared to previous day
Last Week
-7.3%
4,451,885
Compared to previous week
Last Month
-0.5%
19,661,559
Compared to previous month
Last Year
-13.8%
229,754,416
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Peer Dependencies
1
Dev Dependencies
73
@astrojs/check@astrojs/markdown-remark@astrojs/mdx@astrojs/prism@astrojs/sitemap@babel/cli@babel/core@babel/preset-env@docsearch/js@popperjs/core@rollup/plugin-babel@rollup/plugin-commonjs@rollup/plugin-node-resolve@rollup/plugin-replace@stackblitz/sdk@types/js-yaml@types/mime@types/prismjsastroastro-auto-importautoprefixerbundlewatchclean-css-cliclipboardcross-enveslinteslint-config-xoeslint-plugin-htmleslint-plugin-importeslint-plugin-markdowneslint-plugin-unicornfind-unused-sass-variablesgithub-sluggerglobbyhammer-simulatorhtmlparser2image-sizeipjasminejqueryjs-yamlkarmakarma-browserstack-launcherkarma-chrome-launcherkarma-coverage-istanbul-reporterkarma-detect-browserskarma-firefox-launcherkarma-jasminekarma-jasmine-html-reporterkarma-rollup-preprocessorlockfile-lintmimenodemonnpm-run-all2postcsspostcss-cliprettierprettier-plugin-astrorehype-autolink-headingsremarkremark-htmlrolluprollup-plugin-istanbulrtlcsssasssass-trueshelljsstylelintstylelint-config-twbs-bootstrapterserunist-util-visitvnu-jarzod
Bootstrap
Sleek, intuitive, and powerful front-end framework for faster and easier web development.
Explore Bootstrap docs »
Report bug
·
Request feature
·
Themes
·
Blog
Bootstrap 5
Our default branch is for development of our Bootstrap 5 release. Head to the v4-dev branch to view the readme, documentation, and source code for Bootstrap 4.
Table of contents
- Quick start
- Status
- What’s included
- Bugs and feature requests
- Documentation
- Contributing
- Community
- Versioning
- Creators
- Thanks
- Copyright and license
Quick start
Several quick start options are available:
- Download the latest release
- Clone the repo:
git clone https://github.com/twbs/bootstrap.git - Install with npm:
npm install bootstrap@v5.3.7 - Install with yarn:
yarn add bootstrap@v5.3.7 - Install with Bun:
bun add bootstrap@v5.3.7 - Install with Composer:
composer require twbs/bootstrap:5.3.7 - Install with NuGet: CSS:
Install-Package bootstrapSass:Install-Package bootstrap.sass
Read the Getting started page for information on the framework contents, templates, examples, and more.
Status
What’s included
Within the download you’ll find the following directories and files, logically grouping common assets and providing both compiled and minified variations.
Download contents
1bootstrap/ 2├── css/ 3│ ├── bootstrap-grid.css 4│ ├── bootstrap-grid.css.map 5│ ├── bootstrap-grid.min.css 6│ ├── bootstrap-grid.min.css.map 7│ ├── bootstrap-grid.rtl.css 8│ ├── bootstrap-grid.rtl.css.map 9│ ├── bootstrap-grid.rtl.min.css 10│ ├── bootstrap-grid.rtl.min.css.map 11│ ├── bootstrap-reboot.css 12│ ├── bootstrap-reboot.css.map 13│ ├── bootstrap-reboot.min.css 14│ ├── bootstrap-reboot.min.css.map 15│ ├── bootstrap-reboot.rtl.css 16│ ├── bootstrap-reboot.rtl.css.map 17│ ├── bootstrap-reboot.rtl.min.css 18│ ├── bootstrap-reboot.rtl.min.css.map 19│ ├── bootstrap-utilities.css 20│ ├── bootstrap-utilities.css.map 21│ ├── bootstrap-utilities.min.css 22│ ├── bootstrap-utilities.min.css.map 23│ ├── bootstrap-utilities.rtl.css 24│ ├── bootstrap-utilities.rtl.css.map 25│ ├── bootstrap-utilities.rtl.min.css 26│ ├── bootstrap-utilities.rtl.min.css.map 27│ ├── bootstrap.css 28│ ├── bootstrap.css.map 29│ ├── bootstrap.min.css 30│ ├── bootstrap.min.css.map 31│ ├── bootstrap.rtl.css 32│ ├── bootstrap.rtl.css.map 33│ ├── bootstrap.rtl.min.css 34│ └── bootstrap.rtl.min.css.map 35└── js/ 36 ├── bootstrap.bundle.js 37 ├── bootstrap.bundle.js.map 38 ├── bootstrap.bundle.min.js 39 ├── bootstrap.bundle.min.js.map 40 ├── bootstrap.esm.js 41 ├── bootstrap.esm.js.map 42 ├── bootstrap.esm.min.js 43 ├── bootstrap.esm.min.js.map 44 ├── bootstrap.js 45 ├── bootstrap.js.map 46 ├── bootstrap.min.js 47 └── bootstrap.min.js.map
We provide compiled CSS and JS (bootstrap.*), as well as compiled and minified CSS and JS (bootstrap.min.*). Source maps (bootstrap.*.map) are available for use with certain browsers’ developer tools. Bundled JS files (bootstrap.bundle.js and minified bootstrap.bundle.min.js) include Popper.
Bugs and feature requests
Have a bug or a feature request? Please first read the issue guidelines and search for existing and closed issues. If your problem or idea is not addressed yet, please open a new issue.
Documentation
Bootstrap’s documentation, included in this repo in the root directory, is built with Astro and publicly hosted on GitHub Pages at https://getbootstrap.com/. The docs may also be run locally.
Documentation search is powered by Algolia's DocSearch.
Running documentation locally
- Run
npm installto install the Node.js dependencies, including Astro (the site builder). - Run
npm run test(or a specific npm script) to rebuild distributed CSS and JavaScript files, as well as our docs assets. - From the root
/bootstrapdirectory, runnpm run docs-servein the command line. - Open
http://localhost:9001/in your browser, and voilà.
Learn more about using Astro by reading its documentation.
Documentation for previous releases
You can find all our previous releases docs on https://getbootstrap.com/docs/versions/.
Previous releases and their documentation are also available for download.
Contributing
Please read through our contributing guidelines. Included are directions for opening issues, coding standards, and notes on development.
Moreover, if your pull request contains JavaScript patches or features, you must include relevant unit tests. All HTML and CSS should conform to the Code Guide, maintained by Mark Otto.
Editor preferences are available in the editor config for easy use in common text editors. Read more and download plugins at https://editorconfig.org/.
Community
Get updates on Bootstrap’s development and chat with the project maintainers and community members.
- Follow @getbootstrap on X.
- Read and subscribe to The Official Bootstrap Blog.
- Ask questions and explore our GitHub Discussions.
- Discuss, ask questions, and more on the community Discord or Bootstrap subreddit.
- Chat with fellow Bootstrappers in IRC. On the
irc.libera.chatserver, in the#bootstrapchannel. - Implementation help may be found at Stack Overflow (tagged
bootstrap-5). - Developers should use the keyword
bootstrapon packages which modify or add to the functionality of Bootstrap when distributing through npm or similar delivery mechanisms for maximum discoverability.
Versioning
For transparency into our release cycle and in striving to maintain backward compatibility, Bootstrap is maintained under the Semantic Versioning guidelines. Sometimes we screw up, but we adhere to those rules whenever possible.
See the Releases section of our GitHub project for changelogs for each release version of Bootstrap. Release announcement posts on the official Bootstrap blog contain summaries of the most noteworthy changes made in each release.
Creators
Mark Otto
Jacob Thornton
Thanks
Thanks to BrowserStack for providing the infrastructure that allows us to test in real browsers!
Thanks to Netlify for providing us with Deploy Previews!
Sponsors
Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]
Backers
Thank you to all our backers! 🙏 [Become a backer]
Copyright and license
Code and documentation copyright 2011-2025 the Bootstrap Authors. Code released under the MIT License. Docs released under Creative Commons.
Moderate
6.4/10
Summary
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
Affected Versions
>= 1.4.0, < 3.4.1
Patched Versions
3.4.1
Moderate
6.4/10
Summary
Bootstrap Cross-Site Scripting (XSS) vulnerability
Affected Versions
>= 4.0.0, <= 4.6.2
Patched Versions
5.0.0
Moderate
6.4/10
Summary
Bootstrap Cross-Site Scripting (XSS) vulnerability
Affected Versions
>= 2.0.0, <= 3.4.1
Moderate
6.1/10
Summary
XSS vulnerability that affects bootstrap
Affected Versions
< 3.4.0
Patched Versions
3.4.0
Moderate
6.1/10
Summary
bootstrap Cross-site Scripting vulnerability
Affected Versions
< 3.4.0
Patched Versions
3.4.0
Moderate
6.1/10
Summary
Bootstrap vulnerable to Cross-Site Scripting (XSS)
Affected Versions
>= 2.3.0, < 3.4.0
Patched Versions
3.4.0
Moderate
6.1/10
Summary
Bootstrap vulnerable to Cross-Site Scripting (XSS)
Affected Versions
>= 4.0.0, < 4.1.2
Patched Versions
4.1.2
Moderate
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 2.3.0, < 3.4.0
Patched Versions
3.4.0
Moderate
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 4.0.0, < 4.1.2
Patched Versions
4.1.2
Moderate
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 4.0.0, < 4.1.2
Patched Versions
4.1.2
Moderate
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 2.0.4, < 3.4.0
Patched Versions
3.4.0
Moderate
6.1/10
Summary
Bootstrap Cross-site Scripting vulnerability
Affected Versions
>= 4.0.0-beta, < 4.0.0-beta.2
Patched Versions
4.0.0-beta.2
Moderate
6.1/10
Summary
Bootstrap Vulnerable to Cross-Site Scripting
Affected Versions
>= 3.0.0, < 3.4.1
Patched Versions
3.4.1
Moderate
6.1/10
Summary
Bootstrap Vulnerable to Cross-Site Scripting
Affected Versions
>= 4.0.0, < 4.3.1
Patched Versions
4.3.1
Reason
no binaries found in the repo
Reason
58 different organizations found -- score normalized to 10
Details
- Info: contributors work for CSSLint,HackFox,MaxCDN,Orange-OpenSource,PeerBlock,Rundiz-WP,VivreTech,afosto,apple @semantic-release,browser-bugs,caniuse-email,coinbase,colossal,components,dependents,eclipse,foxfile,github,gohugoio,google,gruntjs,h5bp,hiro,hirosystems,htmlhint,imagemin,itccsro,jekyll,liferay,lostisland,maintainers,maker,nodejs,octoenergy,on the prowl,opensourcedesign,orange,orange-business-services sa,owddm,patternfly,pi-hole,poole,primer,rubyloco,semantic-release,stylelint,stylelint-scss,svg-sprite,trimble-oss,trimblemaps,twbs,uncss,upriver,uxsolutions,validator,verizon,w3c,whatwg
Reason
no dangerous workflow patterns detected
Reason
update tool detected
Details
- Info: Dependabot detected: .github/dependabot.yml:1
Reason
license file detected
Details
- Info: License file found in expected location: LICENSE:1
- Info: FSF or OSI recognized license: LICENSE:1
Reason
30 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Reason
SAST tool detected but not run on all commmits
Details
- Warn: 28 commits out of 29 are checked with a SAST tool
- Info: SAST tool detected: CodeQL
Reason
security policy file detected
Details
- Info: Found linked content in security policy: SECURITY.md
- Info: Found text in security policy: SECURITY.md
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy: SECURITY.md
- Info: security policy detected in current repo: SECURITY.md
Reason
23 out of last 30 changesets reviewed before merge -- score normalized to 7
Reason
dependency not pinned by hash detected -- score normalized to 7
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browserstack.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/browserstack.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browserstack.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/browserstack.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bundlewatch.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/bundlewatch.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bundlewatch.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/bundlewatch.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/calibreapp-image-actions.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/calibreapp-image-actions.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/calibreapp-image-actions.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/calibreapp-image-actions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cspell.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/cspell.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/cspell.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/cspell.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/css.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/css.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/css.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/css.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/docs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/docs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/docs.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-close-require.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/issue-close-require.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/issue-labeled.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/js.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/js.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-sass.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/node-sass.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-sass.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/node-sass.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-notes.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/release-notes.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecards.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/scorecards.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecards.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecards.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/scorecards.yml/main?enable=pin
- Info: Dockerfile dependencies are pinned
- Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles
- Info: no insecure (not pinned by hash) dependency downloads found in shell scripts
Reason
badge detected: in_progress
Reason
project is not fuzzed
Reason
0 out of 5 artifacts are signed or have provenance
Details
- Warn: release artifact v5.3.0-alpha1 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/87186776
- Warn: release artifact v5.3.0-alpha1 not signed: https://api.github.com/repos/twbs/bootstrap/releases/87186776
- Warn: release artifact v5.2.3 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/83835184
- Warn: release artifact v5.2.3 not signed: https://api.github.com/repos/twbs/bootstrap/releases/83835184
- Warn: release artifact v5.2.2 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/78817853
- Warn: release artifact v5.2.2 not signed: https://api.github.com/repos/twbs/bootstrap/releases/78817853
- Warn: release artifact v5.2.1 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/76503933
- Warn: release artifact v5.2.1 not signed: https://api.github.com/repos/twbs/bootstrap/releases/76503933
- Warn: release artifact v5.2.0 does not have provenance: https://api.github.com/repos/twbs/bootstrap/releases/72344034
- Warn: release artifact v5.2.0 not signed: https://api.github.com/repos/twbs/bootstrap/releases/72344034
Reason
non read-only tokens detected in GitHub workflows
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/browserstack.yml:12
- Info: topLevel 'contents' permission set to 'read': .github/workflows/bundlewatch.yml:15
- Warn: no topLevel permission defined: .github/workflows/calibreapp-image-actions.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/calibreapp-image-actions.yml/main?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/codeql.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/codeql.yml/main?enable=permissions
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:23
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24
- Info: topLevel 'contents' permission set to 'read': .github/workflows/cspell.yml:14
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/cspell.yml:21
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/cspell.yml:20
- Info: topLevel 'contents' permission set to 'read': .github/workflows/css.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/docs.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-close-require.yml:8
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-labeled.yml:8
- Info: topLevel 'contents' permission set to 'read': .github/workflows/js.yml:15
- Warn: jobLevel 'checks' permission set to 'write': .github/workflows/js.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/js.yml/main?enable=permissions
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/js.yml:22
- Info: topLevel 'contents' permission set to 'read': .github/workflows/lint.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/node-sass.yml:15
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release-notes.yml:10
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-notes.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/twbs/bootstrap/release-notes.yml/main?enable=permissions
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:14
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:26
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:27
Score
6.8
/10
Last Scanned on 2022-12-28
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More