OpenSSF Scorecard v5.6.0, local mode, on gunnar at 4df9a0aa: 5.2 / 10 (the aggregate of the checks local mode runs).
| check | score | reason |
| Binary-Artifacts | 10 / 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |
| Dependency-Update-Tool | 0 / 10 | no update tool detected |
| Fuzzing | 0 / 10 | project is not fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | 0 / 10 | dependency not pinned by hash detected -- score normalized to 0 |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |
| Vulnerabilities | 0 / 10 | 43 existing vulnerabilities detected |
Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.