{"date":"2022-08-15","repo":{"name":"github.com/framework7io/framework7","commit":"592013d862dbef64279a4b6ae99b2ff6e2633d0f"},"scorecard":{"version":"v4.5.0-17-g7772984","commit":"777298477c07c262a4ec7e95ceee839b7b3b75ae"},"score":5.5,"checks":[{"name":"Maintained","score":10,"reason":"19 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Code-Review","score":4,"reason":"GitHub code reviews found for 14 commits out of the last 30 -- score normalized to 4","details":["Warn: no reviews found for commit: 592013d862dbef64279a4b6ae99b2ff6e2633d0f","Warn: no reviews found for commit: 3f8d7e9798a8bcc0e92f89625e70f6cc2c07311f","Warn: no reviews found for commit: e0d4ebe0267bece3782ceae6f4946576bcf36846","Warn: no reviews found for commit: 671b9bf8927826d1c6244bcc468a7ceb5b544d5f","Warn: no reviews found for commit: 48e966fdccb80efaa5c79eb66126adfbbce3f361","Warn: no reviews found for commit: 41a7c5083fa0cee734191d8450a19c268d1b1958","Warn: no reviews found for commit: 03c8a58f833b23c51c8d18e6c9c4527d7bbeaf10","Warn: no reviews found for commit: 03c364498f1db471b0a492248f1bc29ab3bb1177","Warn: no reviews found for commit: 32b6fed541a2e4f3fe5a40c1f50231cc99ba139a","Warn: no reviews found for commit: 2e2305f8e347f6948e9c6c950ab2c98b94ffe884","Warn: no reviews found for commit: 74ab2dc74fede842c755026852461d43d4ff10b6","Warn: no reviews found for commit: 27774e2d2a2eee41b6f7cfa8e7d4831120ea097b","Warn: no reviews found for commit: ae372d744f7b956b23b6d457ee93a1873c2d3ac9","Warn: no reviews found for commit: 1f4f20ee89735858db64ff67620c8450480dedca","Warn: no reviews found for commit: 2bab4a1736c5c53fe0e40cc026858ee5968629fc","Warn: no reviews found for commit: f1b447417ec9adb7c39b24d4d48b9f45e19930d3"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#code-review","short":"Determines if the project requires code review before pull requests (aka merge requests) are merged."}},{"name":"CII-Best-Practices","score":0,"reason":"no badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#cii-best-practices","short":"Determines if the project has a CII Best Practices Badge."}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#vulnerabilities","short":"Determines if the project has open, known unfixed vulnerabilities."}},{"name":"Signed-Releases","score":0,"reason":"0 out of 5 artifacts are signed or have provenance","details":["Warn: release artifact v5.7.6 does not have provenance: https://api.github.com/repos/framework7io/framework7/releases/27091054","Warn: release artifact v5.7.6 not signed: https://api.github.com/repos/framework7io/framework7/releases/27091054","Warn: release artifact v5.7.5 does not have provenance: https://api.github.com/repos/framework7io/framework7/releases/26585654","Warn: release artifact v5.7.5 not signed: https://api.github.com/repos/framework7io/framework7/releases/26585654","Warn: release artifact v5.7.2 does not have provenance: https://api.github.com/repos/framework7io/framework7/releases/26340997","Warn: release artifact v5.7.2 not signed: https://api.github.com/repos/framework7io/framework7/releases/26340997","Warn: release artifact v5.7.1 does not have provenance: https://api.github.com/repos/framework7io/framework7/releases/26092968","Warn: release artifact v5.7.1 not signed: https://api.github.com/repos/framework7io/framework7/releases/26092968","Warn: release artifact v5.7.0 does not have provenance: https://api.github.com/repos/framework7io/framework7/releases/25878549","Warn: release artifact v5.7.0 not signed: https://api.github.com/repos/framework7io/framework7/releases/25878549"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub publishing workflow detected"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Token-Permissions","score":0,"reason":"non read-only tokens detected in GitHub workflows","details":["Warn: no topLevel permission defined: .github/workflows/issue-close-require.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/funkyminds/cleanframes/issue-close-require.yml/master?enable=permissions","Warn: no topLevel permission defined: .github/workflows/issue-labeled.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/funkyminds/cleanframes/issue-labeled.yml/master?enable=permissions"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: : LICENSE:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Pinned-Dependencies","score":8,"reason":"dependency not pinned by hash detected -- score normalized to 8","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-close-require.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/funkyminds/cleanframes/issue-close-require.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/funkyminds/cleanframes/issue-labeled.yml/master?enable=pin","Info: GitHub-owned GitHubActions are pinned","Info: Dockerfile dependencies are pinned","Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles","Info: no insecure (not pinned by hash) dependency downloads found in shell scripts"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned its dependencies."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: Dependabot detected"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#dependency-update-tool","short":"Determines if the project uses a dependency update tool."}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/777298477c07c262a4ec7e95ceee839b7b3b75ae/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}}]}