{"date":"2026-08-17","repo":{"name":"github.com/aws/aws-cdk","commit":"8e37c8d4883de25fbe3c9cb11bb8adc6072ae361"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":5.9,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":0,"reason":"dangerous workflow patterns detected","details":["Warn: untrusted code checkout '${{ github.event.pull_request.head.sha }}': .github/workflows/integration-test-deployment.yml:37","Warn: untrusted code checkout '${{ github.event.pull_request.head.sha }}': .github/workflows/request-cli-integ-test.yml:55","Warn: untrusted code checkout '${{ github.event.pull_request.head.sha }}': .github/workflows/request-cli-integ-test.yml:22"],"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'contents' permission set to 'write': .github/workflows/analytics-metadata-updater.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/close-stale-issues.yml:15","Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql.yml:25","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:28","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:29","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/enum-auto-updater.yml:12","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/enum-static-mapping-updater.yml:12","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/lambda-runtime-tests.yml:12","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-linter.yml:65","Info: jobLevel 'statuses' permission set to 'read': .github/workflows/pr-linter.yml:67","Info: jobLevel 'issues' permission set to 'read': .github/workflows/pr-linter.yml:68","Info: jobLevel 'checks' permission set to 'read': .github/workflows/pr-linter.yml:69","Warn: jobLevel 'checks' permission set to 'write': .github/workflows/security-report.yml:11","Info: jobLevel 'actions' permission set to 'read': .github/workflows/security-report.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/spec-update.yml:15","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/spec-update.yml:85","Info: found token with 'none' permissions: .github/workflows/spec-update.yml:86","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/spec-update.yml:127","Info: found token with 'none' permissions: .github/workflows/sync-from-upstream.yml:1","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/sync-from-upstream.yml:44","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/update-metadata-regions.yml:48","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/yarn-upgrade-need-manual-work.yml:78","Info: jobLevel 'contents' permission set to 'read': .github/workflows/yarn-upgrade-need-manual-work.yml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/yarn-upgrade.yml:13","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/yarn-upgrade.yml:88","Warn: no topLevel permission defined: .github/workflows/analytics-metadata-updater.yml:1","Warn: no topLevel permission defined: .github/workflows/auto-approve.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/check-lfs.yml:6","Warn: no topLevel permission defined: .github/workflows/close-stale-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/close-stale-prs.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/codebuild-pr-build.yml:26","Info: topLevel 'contents' permission set to 'read': .github/workflows/codecov-collect.yml:7","Info: topLevel 'actions' permission set to 'read': .github/workflows/codecov-upload.yml:12","Warn: topLevel 'contents' permission set to 'write': .github/workflows/codecov-upload.yml:10","Warn: no topLevel permission defined: .github/workflows/codeql.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/community-review-timeout.yml:18","Warn: no topLevel permission defined: .github/workflows/ensure-triage-label.yml:1","Warn: no topLevel permission defined: .github/workflows/enum-auto-updater.yml:1","Warn: no topLevel permission defined: .github/workflows/enum-static-mapping-updater.yml:1","Warn: no topLevel permission defined: .github/workflows/github-merit-badger.yml:1","Warn: no topLevel permission defined: .github/workflows/handle-stale-discussions.yml:1","Warn: no topLevel permission defined: .github/workflows/issue-label-assign.yml:1","Warn: no topLevel permission defined: .github/workflows/issue-regression-labeler.yml:1","Warn: no topLevel permission defined: .github/workflows/issue-reprioritization.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-sync.yml:6","Warn: no topLevel permission defined: .github/workflows/lambda-runtime-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/lock-issue-pr-with-message.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/pending-maintainer-action-check.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-build.yml:22","Warn: no topLevel permission defined: .github/workflows/pr-issue-check.yml:1","Warn: no topLevel permission defined: .github/workflows/pr-labeler.yml:1","Warn: no topLevel permission defined: .github/workflows/pr-linter-exemption-labeler.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-linter-review-trigger.yml:17","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-linter.yml:26","Info: topLevel 'contents' permission set to 'read': .github/workflows/project-prioritization-added-on.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/project-prioritization-assignment.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/project-prioritization-bug.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/project-prioritization-needs-attention.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/project-prioritization-r2-assignment.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/project-prioritization-r5-assignment.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/request-cli-integ-test.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/security-guardian.yml:8","Warn: no topLevel permission defined: .github/workflows/security-report.yml:1","Warn: no topLevel permission defined: .github/workflows/spec-update.yml:1","Warn: no topLevel permission defined: .github/workflows/sync-from-upstream.yml:1","Warn: no topLevel permission defined: .github/workflows/unlock-reopened-issue-pr-with-message.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/update-contributors.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/update-metadata-regions.yml:8","Warn: no topLevel permission defined: .github/workflows/yarn-upgrade-need-manual-work.yml:1","Warn: no topLevel permission defined: .github/workflows/yarn-upgrade.yml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":-1,"reason":"internal error: internal error: invalid Dockerfile","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is not required on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/aws/.github/SECURITY.md:1","Info: Found linked content: github.com/aws/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/aws/.github/SECURITY.md:1","Info: Found text in security policy: github.com/aws/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":8,"reason":"5 out of the last 5 releases have a total of 5 signed artifacts.","details":["Info: signed release artifact: aws-cdk-2.265.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.265.0","Info: signed release artifact: aws-cdk-2.264.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.264.0","Info: signed release artifact: aws-cdk-2.263.0.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.263.0","Info: signed release artifact: aws-cdk-2.262.2.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.262.2","Info: signed release artifact: aws-cdk-2.262.1.zip.sig: https://github.com/aws/aws-cdk/releases/tag/v2.262.1","Warn: release artifact v2.265.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/370167907","Warn: release artifact v2.264.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/368106542","Warn: release artifact v2.263.0 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/363212794","Warn: release artifact v2.262.2 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/361815926","Warn: release artifact v2.262.1 does not have provenance: https://api.github.com/repos/aws/aws-cdk/releases/359372965"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"Binary-Artifacts","score":0,"reason":"binaries present in source code","details":["Warn: binary detected: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/integ.assets.directory.lit.js.snapshot/asset.6b84b87243a4a01c592d78e1fd3855c4bfef39328cd0a450cc97e81717fea2a2/sample-jar-asset.jar:1","Warn: binary detected: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/integ.assets.refs.lit.js.snapshot/asset.6b84b87243a4a01c592d78e1fd3855c4bfef39328cd0a450cc97e81717fea2a2/sample-jar-asset.jar:1","Warn: binary detected: packages/@aws-cdk-testing/framework-integ/test/aws-s3-assets/test/sample-asset-directory/sample-jar-asset.jar:1","Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.alias.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1","Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.build-fleet.js.snapshot/asset.b9a6ac85861c7bf3d745d9866a46a450a1b14afa77e28d2c2767e74ce4e37c03/TestApplicationServer:1","Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.build.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1","Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.game-session-queue.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1","Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/integ.queued-matchmaking-configuration.js.snapshot/asset.b95e4173bc399a8f686a4951aa26e01de1ed1e9d981ee1a7f18a15512dbdcb37/TestApplicationServer:1","Warn: binary detected: packages/@aws-cdk/aws-gamelift-alpha/test/my-game-build/TestApplicationServer:1","Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalaspark-etl.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1","Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalaspark-flex-etl.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1","Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalaspark-streaming.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1","Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/integ.job-scalasparkflex-etl.js.snapshot/asset.e305655b966b957f91fcec580e3f8703573eb6b69528c5d52190d72579c91602.jar:1","Warn: binary detected: packages/@aws-cdk/aws-glue-alpha/test/job-jar/helloworld.jar:1","Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/code-asset/WordCount.jar:1","Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/integ.application-code-from-bucket.lit.js.snapshot/asset.8be9e0b5f53d41e9a3b1d51c9572c65f24f8170a7188d0ed57fb7d571de4d577/WordCount.jar:1","Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/integ.application.lit.js.snapshot/asset.8be9e0b5f53d41e9a3b1d51c9572c65f24f8170a7188d0ed57fb7d571de4d577/WordCount.jar:1","Warn: binary detected: packages/@aws-cdk/aws-kinesisanalytics-flink-alpha/test/integ.vpc-application.js.snapshot/asset.8be9e0b5f53d41e9a3b1d51c9572c65f24f8170a7188d0ed57fb7d571de4d577/WordCount.jar:1","Warn: binary detected: packages/aws-cdk-lib/aws-s3-assets/test/sample-asset-directory/sample-jar-asset.jar:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"SAST","score":9,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 26 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/step-scaling-policy.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/util.ts:2","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/intervals.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/util.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/arbitraries/arbitrary-constructs.ts:6","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/aspect.prop.test.ts:3","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/fn.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/private/construct-iteration.prop.test.ts:2","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/private/linked-queue.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/step-scaling-policy.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-applicationautoscaling/test/util.ts:2","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/intervals.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/aws-autoscaling-common/test/util.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/arbitraries/arbitrary-constructs.ts:6","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/aspect.prop.test.ts:3","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/fn.test.ts:1","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/private/construct-iteration.prop.test.ts:2","Info: TypeScriptPropertyBasedTesting integration found: packages/aws-cdk-lib/core/test/private/linked-queue.test.ts:1"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}}]}