{
  "history": [
    {
      "added": 0,
      "commit": "e447b655502f2058630e6ee03f2ea1c3789fe166",
      "date": "2026-11-01",
      "dependencies": 68,
      "errors": [],
      "fixable": 1,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "6.20.5",
      "release_changed": false,
      "release_integrity": "no-linux-binary",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 4.7,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 1,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 1,
        "Low": 0,
        "Medium": 3,
        "files": 13
      }
    },
    {
      "added": 0,
      "commit": "e447b655502f2058630e6ee03f2ea1c3789fe166",
      "date": "2026-11-02",
      "dependencies": 68,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "kev": null,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "6.20.5",
      "release_changed": false,
      "release_integrity": "no-linux-binary",
      "removed": 0,
      "resolved_vulnerabilities": 1,
      "scorecard": 4.7,
      "scorecard_date": "2026-10-19",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 0,
      "workflow": {
        "High": 1,
        "Low": 0,
        "Medium": 3,
        "files": 13
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Static Application Security Testing (SAST) \u203a Language-specific \u203a PHP",
    "changes": {
      "added": [],
      "any": true,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "6.20.5",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [
        {
          "aliases": [],
          "ecosystem": "github",
          "fix_state": "fixed",
          "fixed_in": [
            "2.37.1"
          ],
          "id": "GHSA-5wxr-w449-57cm",
          "location": ".github/workflows/windows-ci.yml",
          "osv_confirmed": false,
          "package": "shivammathur/setup-php",
          "severity": "Medium",
          "url": "https://github.com/advisories/GHSA-5wxr-w449-57cm",
          "version": "v2"
        }
      ],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "e447b655502f2058630e6ee03f2ea1c3789fe166",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/amp",
        "purl": "pkg:composer/amphp/amp@v3.1.0",
        "version": "v3.1.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/byte-stream",
        "purl": "pkg:composer/amphp/byte-stream@v2.1.1",
        "version": "v2.1.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/cache",
        "purl": "pkg:composer/amphp/cache@v2.0.1",
        "version": "v2.0.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/dns",
        "purl": "pkg:composer/amphp/dns@v2.4.0",
        "version": "v2.4.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/parallel",
        "purl": "pkg:composer/amphp/parallel@v2.3.1",
        "version": "v2.3.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/parser",
        "purl": "pkg:composer/amphp/parser@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/pipeline",
        "purl": "pkg:composer/amphp/pipeline@v1.2.2",
        "version": "v1.2.2"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/process",
        "purl": "pkg:composer/amphp/process@v2.0.3",
        "version": "v2.0.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/serialization",
        "purl": "pkg:composer/amphp/serialization@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/socket",
        "purl": "pkg:composer/amphp/socket@v2.3.1",
        "version": "v2.3.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "amphp/sync",
        "purl": "pkg:composer/amphp/sync@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "composer/pcre",
        "purl": "pkg:composer/composer/pcre@3.3.2",
        "version": "3.3.2"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "composer/semver",
        "purl": "pkg:composer/composer/semver@3.4.3",
        "version": "3.4.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "composer/xdebug-handler",
        "purl": "pkg:composer/composer/xdebug-handler@3.0.5",
        "version": "3.0.5"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "daverandom/libdns",
        "purl": "pkg:composer/daverandom/libdns@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "doctrine/deprecations",
        "purl": "pkg:composer/doctrine/deprecations@1.1.4",
        "version": "1.1.4"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "fidry/console",
        "purl": "pkg:composer/fidry/console@0.6.11",
        "version": "0.6.11"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "fidry/filesystem",
        "purl": "pkg:composer/fidry/filesystem@1.2.3",
        "version": "1.2.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "humbug/box",
        "purl": "pkg:composer/humbug/box@4.6.3",
        "version": "4.6.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "humbug/php-scoper",
        "purl": "pkg:composer/humbug/php-scoper@0.18.17",
        "version": "0.18.17"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "jetbrains/phpstorm-stubs",
        "purl": "pkg:composer/jetbrains/phpstorm-stubs@v2024.3",
        "version": "v2024.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "justinrainbow/json-schema",
        "purl": "pkg:composer/justinrainbow/json-schema@5.3.0",
        "version": "5.3.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "kelunik/certificate",
        "purl": "pkg:composer/kelunik/certificate@v1.1.3",
        "version": "v1.1.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "league/uri",
        "purl": "pkg:composer/league/uri@7.5.1",
        "version": "7.5.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "league/uri-interfaces",
        "purl": "pkg:composer/league/uri-interfaces@7.5.0",
        "version": "7.5.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "nikic/iter",
        "purl": "pkg:composer/nikic/iter@v2.4.1",
        "version": "v2.4.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "nikic/php-parser",
        "purl": "pkg:composer/nikic/php-parser@v5.4.0",
        "version": "v5.4.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "phpdocumentor/reflection-common",
        "purl": "pkg:composer/phpdocumentor/reflection-common@2.2.0",
        "version": "2.2.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "phpdocumentor/reflection-docblock",
        "purl": "pkg:composer/phpdocumentor/reflection-docblock@5.6.1",
        "version": "5.6.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "phpdocumentor/type-resolver",
        "purl": "pkg:composer/phpdocumentor/type-resolver@1.10.0",
        "version": "1.10.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "phpstan/phpdoc-parser",
        "purl": "pkg:composer/phpstan/phpdoc-parser@2.1.0",
        "version": "2.1.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "psr/container",
        "purl": "pkg:composer/psr/container@2.0.2",
        "version": "2.0.2"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "psr/event-dispatcher",
        "purl": "pkg:composer/psr/event-dispatcher@1.0.0",
        "version": "1.0.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "psr/http-factory",
        "purl": "pkg:composer/psr/http-factory@1.1.0",
        "version": "1.1.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "psr/http-message",
        "purl": "pkg:composer/psr/http-message@2.0",
        "version": "2.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "psr/log",
        "purl": "pkg:composer/psr/log@3.0.2",
        "version": "3.0.2"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "revolt/event-loop",
        "purl": "pkg:composer/revolt/event-loop@v1.0.7",
        "version": "v1.0.7"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "BSD-3-Clause"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "sebastian/diff",
        "purl": "pkg:composer/sebastian/diff@5.1.1",
        "version": "5.1.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "seld/jsonlint",
        "purl": "pkg:composer/seld/jsonlint@1.11.0",
        "version": "1.11.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "seld/phar-utils",
        "purl": "pkg:composer/seld/phar-utils@1.2.1",
        "version": "1.2.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/console",
        "purl": "pkg:composer/symfony/console@v7.2.1",
        "version": "v7.2.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/deprecation-contracts",
        "purl": "pkg:composer/symfony/deprecation-contracts@v3.5.1",
        "version": "v3.5.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/event-dispatcher-contracts",
        "purl": "pkg:composer/symfony/event-dispatcher-contracts@v3.5.1",
        "version": "v3.5.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/filesystem",
        "purl": "pkg:composer/symfony/filesystem@v7.2.0",
        "version": "v7.2.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/finder",
        "purl": "pkg:composer/symfony/finder@v7.2.2",
        "version": "v7.2.2"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/polyfill-ctype",
        "purl": "pkg:composer/symfony/polyfill-ctype@v1.31.0",
        "version": "v1.31.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/polyfill-iconv",
        "purl": "pkg:composer/symfony/polyfill-iconv@v1.31.0",
        "version": "v1.31.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/polyfill-intl-grapheme",
        "purl": "pkg:composer/symfony/polyfill-intl-grapheme@v1.31.0",
        "version": "v1.31.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/polyfill-intl-normalizer",
        "purl": "pkg:composer/symfony/polyfill-intl-normalizer@v1.31.0",
        "version": "v1.31.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/polyfill-mbstring",
        "purl": "pkg:composer/symfony/polyfill-mbstring@v1.31.0",
        "version": "v1.31.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/polyfill-php84",
        "purl": "pkg:composer/symfony/polyfill-php84@v1.31.0",
        "version": "v1.31.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/process",
        "purl": "pkg:composer/symfony/process@v7.2.0",
        "version": "v7.2.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/service-contracts",
        "purl": "pkg:composer/symfony/service-contracts@v3.5.1",
        "version": "v3.5.1"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/string",
        "purl": "pkg:composer/symfony/string@v7.2.0",
        "version": "v7.2.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "symfony/var-dumper",
        "purl": "pkg:composer/symfony/var-dumper@v7.2.3",
        "version": "v7.2.3"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "thecodingmachine/safe",
        "purl": "pkg:composer/thecodingmachine/safe@v3.0.0",
        "version": "v3.0.0"
      },
      {
        "ecosystem": "composer",
        "licenses": [
          "MIT"
        ],
        "location": "vendor-bin/box/composer.lock",
        "name": "webmozart/assert",
        "purl": "pkg:composer/webmozart/assert@1.11.0",
        "version": "1.11.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/bcc.yml",
        "name": "actions/cache",
        "purl": "pkg:github/actions/cache@v5",
        "version": "v5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/announce-release.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v6",
        "version": "v6"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/perf-comment.yml",
        "name": "actions/download-artifact",
        "purl": "pkg:github/actions/download-artifact@v8.0.2",
        "version": "v8.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build-stubs.yml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v7.0.1",
        "version": "v7.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/perf.yml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v7.0.2",
        "version": "v7.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build-docker.yml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@v4",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build-docker.yml",
        "name": "fkirc/skip-duplicate-actions",
        "purl": "pkg:github/fkirc/skip-duplicate-actions@v5.3.2",
        "version": "v5.3.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/pr-labels.yml",
        "name": "mheap/github-action-required-labels",
        "purl": "pkg:github/mheap/github-action-required-labels@v5",
        "version": "v5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/announce-release.yml",
        "name": "shivammathur/setup-php",
        "purl": "pkg:github/shivammathur/setup-php@v2",
        "version": "v2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/macos-scan.yml",
        "name": "shivammathur/setup-php",
        "purl": "pkg:github/shivammathur/setup-php@v2.40.0",
        "version": "v2.40.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/build-phar.yml",
        "name": "svenstaro/upload-release-action",
        "purl": "pkg:github/svenstaro/upload-release-action@v2",
        "version": "v2"
      }
    ],
    "description": "Analyze PHP code for type and security issues",
    "errors": [],
    "excluded_matches": {
      "action reference to a moving tag or branch": 1
    },
    "id": "vimeo__psalm",
    "manifests": [
      ".github/workflows/announce-release.yml",
      ".github/workflows/auto-release.yml",
      ".github/workflows/bcc.yml",
      ".github/workflows/build-docker.yml",
      ".github/workflows/build-phar.yml",
      ".github/workflows/build-stubs.yml",
      ".github/workflows/ci.yml",
      ".github/workflows/macos-scan.yml",
      ".github/workflows/perf-comment.yml",
      ".github/workflows/perf.yml",
      ".github/workflows/pr-labels.yml",
      ".github/workflows/shepherd.yml",
      ".github/workflows/windows-ci.yml",
      "assets/psalm-phar/composer.json",
      "composer.json",
      "vendor-bin/bcc/composer.json",
      "vendor-bin/box/composer.json",
      "vendor-bin/box/composer.lock"
    ],
    "name": "psalm",
    "osv": {
      "advisories": 0,
      "available": true,
      "confirmed": 0,
      "osv_only": [],
      "warning": null
    },
    "ref": "6.20.5",
    "ref_kind": "release",
    "release_integrity": {
      "assets": 2,
      "checksums_published": false,
      "methods": [],
      "provenance_published": false,
      "sbom_published": false,
      "signatures_published": true,
      "verdict": "no-linux-binary"
    },
    "released_at": "2026-10-31T16:27:00Z",
    "repository": "vimeo/psalm",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 109 shared packages \u2014 no actual upgrades",
        "Core system packages stable: composer (57), github (38), file (14) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:08:41+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "CII-Best-Practices",
          "reason": "no effort to earn an OpenSSF best practices badge detected",
          "score": 0
        },
        {
          "name": "Code-Review",
          "reason": "Found 0/5 approved changesets -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "SAST",
          "reason": "SAST tool is not run on all commits -- score normalized to 0",
          "score": 0
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file not detected",
          "score": 0
        },
        {
          "name": "Signed-Releases",
          "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
          "score": 8
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Branch-Protection",
          "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
          "score": -1
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no workflows found",
          "score": -1
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow not detected",
          "score": -1
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "no dependencies found",
          "score": -1
        },
        {
          "name": "Token-Permissions",
          "reason": "No tokens found",
          "score": -1
        }
      ],
      "date": "2026-10-19",
      "score": 4.7,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [],
    "workflow_audit": {
      "files": 13,
      "findings": [
        {
          "confidence": "Medium",
          "description": "use of fundamentally insecure workflow trigger",
          "file": ".github/workflows/perf-comment.yml",
          "line": 6,
          "note": "this workflow",
          "rule": "dangerous-triggers",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#dangerous-triggers"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/bcc.yml",
          "line": 5,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "code injection via template expansion",
          "file": ".github/workflows/build-stubs.yml",
          "line": 97,
          "note": "this step",
          "rule": "template-injection",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/pr-labels.yml",
          "line": 6,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "action functionality is already included by the runner",
          "file": ".github/workflows/build-phar.yml",
          "line": 86,
          "note": "this step",
          "rule": "superfluous-actions",
          "severity": "Informational",
          "url": "https://docs.zizmor.sh/audits/#superfluous-actions"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}