OpenSSF Scorecard v5.6.0, local mode, on gunnar at bb6a6ca4: 8.6 / 10 (the aggregate of the checks local mode runs).
| check | score | reason |
| Binary-Artifacts | 10 / 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |
| Dependency-Update-Tool | 10 / 10 | update tool detected |
| Fuzzing | 10 / 10 | project is fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | 10 / 10 | all dependencies are pinned |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |
| Vulnerabilities | 5 / 10 | 5 existing vulnerabilities detected |
Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.