Reason

no dangerous workflow patterns detected

Reason

no binaries found in the repo

Reason

license file detected

Details

• Info: project has a license file: LICENSE.md:0
• Warn: project license file does not contain an FSF or OSI license.

Reason

1 existing vulnerabilities detected

Details

• Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw

Reason

2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1

Reason

Found 5/28 approved changesets -- score normalized to 1

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/main.yml:1
• Info: no jobLevel write permissions found

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/PaulLeCam/react-leaflet/main.yml/master?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/PaulLeCam/react-leaflet/main.yml/master?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/PaulLeCam/react-leaflet/main.yml/master?enable=pin
• Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 1 third-party GitHubAction dependencies pinned

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

security policy file not detected

Details

• Warn: no security policy file detected
• Warn: no security file to analyze
• Warn: no security file to analyze
• Warn: no security file to analyze

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

SAST tool is not run on all commits -- score normalized to 0

Details

• Warn: 0 commits out of 7 are checked with a SAST tool