runs/scorecard-gunnar/20261101T0230Z-c6c50dd6/run.json
{
"pipeline": "scorecard-gunnar",
"repo": "gunnar",
"branch": "master",
"sha": "c6c50dd6d8100b475fc05a764ee6564e2d5fb29e",
"trigger": "cron 30 2 * * *",
"status": "green",
"run_id": "explorer-run_pipeline-1793500215000",
"queued": "",
"started": "2026-11-01T02:30:15.003317472+00:00",
"ended": "2026-11-01T02:31:26.774512492+00:00",
"duration_s": 71,
"reason": "",
"dir": "runs/scorecard-gunnar/20261101T0230Z-c6c50dd6",
"summary": "OpenSSF Scorecard v5.6.0, local mode, on `gunnar` at `c6c50dd6`: **9.2 / 10** (the aggregate of the checks local mode runs).\n\n| check | score | reason |\n|---|---|---|\n| Binary-Artifacts | 10 / 10 | no binaries found in the repo |\n| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |\n| Dependency-Update-Tool | 10 / 10 | update tool detected |\n| Fuzzing | 10 / 10 | project is fuzzed |\n| License | 9 / 10 | license file detected |\n| Packaging | inconclusive | packaging workflow not detected |\n| Pinned-Dependencies | 10 / 10 | all dependencies are pinned |\n| SAST | 0 / 10 | no SAST tool detected |\n| Security-Policy | 10 / 10 | security policy file detected |\n| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |\n| Vulnerabilities | 10 / 10 | 0 existing vulnerabilities detected |\n\nNot run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.\n"
}