Reason

no dangerous workflow patterns detected

Reason

no binaries found in the repo

Reason

license file detected

Details

• Info: project has a license file: license:0
• Info: FSF or OSI recognized license: MIT License: license:0

Reason

0 existing vulnerabilities detected

Reason

security policy file detected

Details

• Info: security policy file detected: github.com/syntax-tree/.github/security.md:1
• Info: Found linked content: github.com/syntax-tree/.github/security.md:1
• Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/syntax-tree/.github/security.md:1
• Info: Found text in security policy: github.com/syntax-tree/.github/security.md:1

Reason

0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0

Reason

Found 0/30 approved changesets -- score normalized to 0

Reason

detected GitHub workflow tokens with excessive permissions

Details

• Warn: no topLevel permission defined: .github/workflows/bb.yml:1
• Warn: no topLevel permission defined: .github/workflows/main.yml:1
• Info: no jobLevel write permissions found

Reason

no SAST tool detected

Details

• Warn: no pull requests merged into dev branch

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

• Warn: third-party GitHubAction not pinned by hash: .github/workflows/bb.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/unist-util-visit-parents/bb.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/unist-util-visit-parents/main.yml/main?enable=pin
• Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/unist-util-visit-parents/main.yml/main?enable=pin
• Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/unist-util-visit-parents/main.yml/main?enable=pin
• Warn: npmCommand not pinned by hash: .github/workflows/main.yml:15
• Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
• Info: 0 out of 2 third-party GitHubAction dependencies pinned
• Info: 0 out of 1 npmCommand dependencies pinned

Reason

no effort to earn an OpenSSF best practices badge detected

Reason

project is not fuzzed

Details

• Warn: no fuzzer integrations found

Reason

branch protection not enabled on development/release branches

Details

• Warn: branch protection not enabled for branch 'main'