Reason

no binaries found in the repo

Reason

no dangerous workflow patterns detected

Reason

license file detected

Details

• Info: project has a license file: LICENSE:0
• Info: FSF or OSI recognized license: MIT License: LICENSE:0

Reason

Found 0/12 approved changesets -- score normalized to 0

Reason

project is archived

Details

• Warn: Repository is archived.

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/main.yml:1
• Info: no jobLevel write permissions found

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/Asjas/fastify-shopify-auth/main.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/Asjas/fastify-shopify-auth/main.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/Asjas/fastify-shopify-auth/main.yml/master?enable=pin
• Info: 0 out of 3 GitHub-owned GitHubAction dependencies pinned

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'master'

Reason

SAST tool is not run on all commits -- score normalized to 0

Details

• Warn: 0 commits out of 20 are checked with a SAST tool

Reason

38 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
• Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
• Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
• Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
• Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
• Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
• Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
• Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
• Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
• Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
• Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
• Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
• Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
• Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
• Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
• Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
• Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
• Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
• Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
• Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
• Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
• Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
• Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
• Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
• Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
• Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
• Warn: Project is vulnerable to: GHSA-44c6-4v22-4mhx
• Warn: Project is vulnerable to: GHSA-4x5v-gmq8-25ch
• Warn: Project is vulnerable to: GHSA-hxcc-f52p-wc94
• Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6
• Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj
• Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
• Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
• Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
• Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
• Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
• Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
• Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh