{"date":"2026-07-13","repo":{"name":"github.com/aws/amazon-sagemaker-examples","commit":"5bb2687b45f114e616c08160bd52b76ae28e59f6"},"scorecard":{"version":"v5.5.1-0.20260519155427-916bfc57fa74","commit":"916bfc57fa7431467a33a5a013cba3f8a0c1ec50"},"score":4.5,"checks":[{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":8,"reason":"Found 25/30 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#code-review"}},{"name":"Maintained","score":5,"reason":"6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#maintained"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#cii-best-practices"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected:        prepare_data/sm-processing_spark_processing/code/spark-test-app.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.txt:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE.txt:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#signed-releases"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/aws/.github/SECURITY.md:1","Info: Found linked content: github.com/aws/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/aws/.github/SECURITY.md:1","Info: Found text in security policy: github.com/aws/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#security-policy"}},{"name":"Branch-Protection","score":1,"reason":"branch protection is not maximal on development and all release branches","details":["Warn: branch protection not enabled for branch 'default'","Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Info: required approving review count is 2 on branch 'main'","Info: codeowner review is required on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 1 commits out of 29 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Info: Possibly incomplete results: error parsing shell code: reached EOF without matching { with }:      deploy_and_monitor/sm-xgboost_bring_your_own_model/out.sh:0","Warn: containerImage not pinned by hash:        prepare_data/sm-ground_truth_active_learning_workflow_bring_your_own_model/container/Dockerfile:3: pin your Docker image by updating tensorflow/tensorflow:latest-py3 to tensorflow/tensorflow:latest-py3@sha256:14ec674cefd622aa9d45f07485500da254acaf8adfef80bd0f279db03c735689","Warn: containerImage not pinned by hash:        prepare_data/sm-processing_feature_transformation_with_dask/container/Dockerfile:1: pin your Docker image by updating continuumio/miniconda3:4.7.12 to continuumio/miniconda3:4.7.12@sha256:6c979670684d970f8ba934bf9b7bf42e77c30a22eb96af1f30a039b484719159","Warn: containerImage not pinned by hash:       build_and_train_models/sm-jax_bring_your_own/docker/Dockerfile:16","Warn: containerImage not pinned by hash:       build_and_train_models/sm-marketplace_build_model_package_for_listing/src/Dockerfile:1: pin your Docker image by updating jupyter/scipy-notebook to jupyter/scipy-notebook@sha256:fca4bcc9cbd49d9a15e0e4df6c666adf17776c950da9fa94a4f0a045d5c4ad33","Warn: containerImage not pinned by hash:       build_and_train_models/sm-marketplace_building_your_own_container_as_package/container/Dockerfile:5: pin your Docker image by updating ubuntu:18.04 to ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98","Warn: containerImage not pinned by hash:       build_and_train_models/sm-scikit_build_your_own_container/container/Dockerfile:5: pin your Docker image by updating ubuntu:18.04 to ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98","Warn: containerImage not pinned by hash:       build_and_train_models/sm-smddp_bert/Dockerfile:4","Warn: containerImage not pinned by hash:      deploy_and_monitor/sm-batch_transform_pca_dbscan_movie_clusters/Dockerfile:1: pin your Docker image by updating ubuntu:16.04 to ubuntu:16.04@sha256:1f1a2d56de1d604801a9671f301190704c25d604a416f59e03c04f5c6ffee0d6","Warn: containerImage not pinned by hash:      deploy_and_monitor/sm-batch_transform_with_torchserve/docker/Dockerfile:1","Warn: containerImage not pinned by hash:      deploy_and_monitor/sm-mme_with_torchserve/workspace/docker/Dockerfile:3","Warn: containerImage not pinned by hash:      deploy_and_monitor/sm-model_monitor_byoc_llm_monitor/Dockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982","Warn: containerImage not pinned by hash:      deploy_and_monitor/sm-multi_model_endpoint_bring_your_own_container/container/Dockerfile:1: pin your Docker image by updating ubuntu:18.04 to ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98","Warn: containerImage not pinned by hash:      deploy_and_monitor/sm-triton_inferentia2/docker/Dockerfile:2","Warn: containerImage not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/1_trainning_sft/docker/Dockerfile:3: pin your Docker image by updating hiyouga/llamafactory:latest to hiyouga/llamafactory:latest@sha256:6bf07ef2e522eaab7767674dc18d8b61cd2131ee7bca531d0f33b87a0801c750","Warn: containerImage not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:3: pin your Docker image by updating nvcr.io/nvidia/pytorch:25.05-py3 to nvcr.io/nvidia/pytorch:25.05-py3@sha256:a0b4dc04f3ca1e539a5c6ea06f79bc45a33d5acd5cbf87dce7910365a924227c","Warn: containerImage not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/3_deployment/docker/Dockerfile:2: pin your Docker image by updating vllm/vllm-openai:latest to vllm/vllm-openai:latest@sha256:fc56161ee42a011aeee78b65d0a81b6683c7d04402fd40503d14d4d6c98f07cb","Warn: containerImage not pinned by hash:    ml_ops/sm-pipelines_local_mode/code/training/Dockerfile:1: pin your Docker image by updating pytorch/pytorch:1.12.1-cuda11.3-cudnn8-runtime to pytorch/pytorch:1.12.1-cuda11.3-cudnn8-runtime@sha256:0bc0971dc8ae319af610d493aced87df46255c9508a8b9e9bc365f11a56e7b75","Warn: pipCommand not pinned by hash:        prepare_data/sm-ground_truth_active_learning_workflow_bring_your_own_model/container/Dockerfile:7","Warn: pipCommand not pinned by hash:       build_and_train_models/sm-marketplace_build_model_package_for_listing/src/Dockerfile:9","Warn: downloadThenRun not pinned by hash:       build_and_train_models/sm-marketplace_building_your_own_container_as_package/container/Dockerfile:22-24","Warn: pipCommand not pinned by hash:       build_and_train_models/sm-marketplace_building_your_own_container_as_package/container/Dockerfile:22-24","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-batch_transform_with_torchserve/docker/Dockerfile:28","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-batch_transform_with_torchserve/docker/Dockerfile:29","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-batch_transform_with_torchserve/docker/Dockerfile:42","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-batch_transform_with_torchserve/docker/Dockerfile:43","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-batch_transform_with_torchserve/docker/Dockerfile:44","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-mme_with_torchserve/workspace/docker/Dockerfile:7","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-model_monitor_byoc_llm_monitor/Dockerfile:20","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/1_trainning_sft/docker/Dockerfile:7","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:45","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:57-66","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:69-73","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:76","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:87","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/2_trainning_grpo/docker/Dockerfile:114","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/3_deployment/docker/Dockerfile:5-7","Warn: pipCommand not pinned by hash:     generative_ai/sm-qwen3_8b_fine_tune_and_deploy/3_deployment/docker/Dockerfile:5-7","Warn: pipCommand not pinned by hash:       build_and_train_models/sm-script_mode_distributed_training_horovod_tensorflow/setup.sh:41","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_mme_bert_trt/workspace/generate_models.sh:2","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_mme_gpu_ensemble_dali/workspace/generate_model_trt.sh:3","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_nlp_bert/workspace/generate_models.sh:2","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_realtime_sme_flan_t5/workspace/create_hf_env.sh:7","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_realtime_sme_flan_t5/workspace/create_hf_env.sh:8","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_realtime_sme_flan_t5/workspace/create_hf_env.sh:9","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_tensorrt-sentence_transformer/conda_dependencies.sh:7","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_tensorrt-sentence_transformer/conda_dependencies.sh:8","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_tensorrt-sentence_transformer/conda_dependencies.sh:9","Warn: pipCommand not pinned by hash:      deploy_and_monitor/sm-triton_tensorrt-sentence_transformer/workspace/generate_model_trt.sh:3","Info:   0 out of  17 containerImage dependencies pinned","Info:   0 out of  30 pipCommand dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/916bfc57fa7431467a33a5a013cba3f8a0c1ec50/docs/checks.md#pinned-dependencies"}}]}