The defaults will make the heading anchors behave as close to how GitHub behaves as possible.
Name
Description
Default
className
name of the class that will be added to the anchor tag
anchor
prefixHeadingIds
add a prefix to each heading ID. (see security note below)
true
prefix
if prefixHeadingIds is true, use this string to prefix each ID.
user-content-
enableHeadingLinkIcons
Adds the icon next to each heading
true
linkIcon
If enableHeadingLinkIcons is true, use this to supply a custom icon (or anything really)
resetSlugger
reset the slugger counter between .render calls for duplicate headers. (See tests for example)
true
Why should I prefix heading IDs?
When using user generated content, its possible to run into DOM Clobbering when heading IDs are generated. Since IDs are used by JavaScript and CSS, a user could craft a page that breaks functionality or styles. A good way to avoid clobbering is to add a prefix to every generated ID to ensure they cannot overlap with existing IDs.
If you have full control over the content, there is less of a risk, but be aware that strange bugs related to DOM Clobbering are still possible!
For more information, here are some good resources on the topic:
One solution is to write some client side JavaScript to force non-prefixed hashes to jump to prefixed anchors. This is how its handled on GitHub and npmjs.com.
Check out marky-deep-links for an example (works great with browserify or webpack).
Info: FSF or OSI recognized license: ISC License: LICENSE.md:0
Reason
Found 5/24 approved changesets -- score normalized to 2
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Warn: no security policy file detected
Warn: no security file to analyze
Warn: no security file to analyze
Warn: no security file to analyze
Reason
project is not fuzzed
Details
Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Warn: 0 commits out of 12 are checked with a SAST tool
Score
3.3
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.