{"date":"2026-07-30T13:31:18Z","repo":{"name":"github.com/mermaid-js/mermaid","commit":"04f8cbfa51caa88b21a17f2840a7596a2bd4db88"},"scorecard":{"version":"v5.3.0","commit":"c22063e786c11f9dd714d777a687ff7c4599b600"},"score":6.7,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#maintained"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: RenovateBot: renovate.json:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#dependency-update-tool"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:22","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/link-checker.yml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-labeler.yml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-preview.yml:21","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:17","Info: topLevel 'contents' permission set to 'read': .github/workflows/autofix.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/build-docs.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/check-readme-in-sync.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:15","Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e-applitools.yml:17","Warn: topLevel 'contents' permission set to 'write': .github/workflows/e2e-timings.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e.yml:27","Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-triage.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/link-checker.yml:16","Warn: topLevel 'contents' permission set to 'write': .github/workflows/lint.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-labeled.yml:7","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-labeler.yml:15","Info: topLevel 'contents' permission set to 'read': .github/workflows/publish-docs.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-preview-publish.yml:9","Warn: topLevel 'packages' permission set to 'write': .github/workflows/release-preview-publish.yml:10","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-preview.yml:13","Warn: topLevel 'actions' permission set to 'write': .github/workflows/release-preview.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/renovatebot-config-lint.yml:20","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:6","Warn: no topLevel permission defined: .github/workflows/unlock-reopened-issues.yml:1","Warn: no topLevel permission defined: .github/workflows/update-browserlist.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/validate-lockfile.yml:11"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: .esbuild/dev-explorer/public/libavoid.wasm:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":9,"reason":"dependency not pinned by hash detected -- score normalized to 9","details":["Warn: npmCommand not pinned by hash: .github/workflows/release-preview-publish.yml:38","Warn: npmCommand not pinned by hash: .github/workflows/release.yml:37","Info:  57 out of  57 GitHub-owned GitHubAction dependencies pinned","Info:  35 out of  35 third-party GitHubAction dependencies pinned","Info:   1 out of   1 containerImage dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#pinned-dependencies"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#license"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#cii-best-practices"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#signed-releases"}},{"name":"SAST","score":10,"reason":"SAST tool detected","details":["Info: SAST configuration detected: CodeQL","Info: SAST configuration detected: Hadolint","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#sast"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#fuzzing"}},{"name":"Branch-Protection","score":1,"reason":"branch protection is not maximal on development and all release branches","details":["Warn: branch protection not enabled for branch 'release/10.9.5'","Info: 'allow deletion' disabled on branch 'develop'","Info: 'force pushes' disabled on branch 'develop'","Warn: branch 'develop' does not require approvers","Warn: codeowners review is not required on branch 'develop'","Info: status check found to merge onto on branch 'develop'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/mermaid-js/.github/SECURITY.md:1","Info: Found linked content: github.com/mermaid-js/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/mermaid-js/.github/SECURITY.md:1","Info: Found text in security policy: github.com/mermaid-js/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":0,"reason":"95 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-4x5r-pxfx-6jf8","Warn: Project is vulnerable to: GHSA-2g4f-4pwh-qvx6","Warn: Project is vulnerable to: GHSA-42h9-826w-cgv3","Warn: Project is vulnerable to: GHSA-7q8q-rj6j-mhjq","Warn: Project is vulnerable to: GHSA-f4gw-2p7v-4548","Warn: Project is vulnerable to: GHSA-gcfj-64vw-6mp9","Warn: Project is vulnerable to: GHSA-hcpx-6fm6-wx23","Warn: Project is vulnerable to: GHSA-jqh4-m9w3-8hp9","Warn: Project is vulnerable to: GHSA-mmx7-hfxf-jppx","Warn: Project is vulnerable to: GHSA-mwf2-3pr3-8698","Warn: Project is vulnerable to: GHSA-pmv8-rq9r-6j72","Warn: Project is vulnerable to: GHSA-xj6q-8x83-jv6g","Warn: Project is vulnerable to: GHSA-v422-hmwv-36x6","Warn: Project is vulnerable to: GHSA-3jxr-9vmj-r5cp","Warn: Project is vulnerable to: GHSA-f886-m6hf-6m8v","Warn: Project is vulnerable to: GHSA-mh99-v99m-4gvg","Warn: Project is vulnerable to: GHSA-jxxr-4gwj-5jf2","Warn: Project is vulnerable to: GHSA-737v-mqg7-c878","Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99","Warn: Project is vulnerable to: GHSA-g7r4-m6w7-qqqr","Warn: Project is vulnerable to: GHSA-4c8g-83qw-93j6","Warn: Project is vulnerable to: GHSA-q3j6-qgpj-74h6","Warn: Project is vulnerable to: GHSA-v2hh-gcrm-f6hx","Warn: Project is vulnerable to: GHSA-v39h-62p7-jpjc","Warn: Project is vulnerable to: GHSA-c96f-x56v-gq3h","Warn: Project is vulnerable to: GHSA-25h7-pfq9-p65f","Warn: Project is vulnerable to: GHSA-rf6f-7fwh-wjgh","Warn: Project is vulnerable to: GHSA-r4q5-vmmm-2653","Warn: Project is vulnerable to: GHSA-hmw2-7cc7-3qxx","Warn: Project is vulnerable to: GHSA-5j98-mcp5-4vw2","Warn: Project is vulnerable to: GHSA-64mm-vxmg-q3vj","Warn: Project is vulnerable to: GHSA-52cp-r559-cp3m","Warn: Project is vulnerable to: GHSA-h67p-54hq-rp68","Warn: Project is vulnerable to: GHSA-mh29-5h37-fv8m","Warn: Project is vulnerable to: GHSA-v6wh-96g9-6wx3","Warn: Project is vulnerable to: GHSA-22p9-wv53-3rq4","Warn: Project is vulnerable to: GHSA-v245-v573-v5vm","Warn: Project is vulnerable to: GHSA-f23m-r3pf-42rh / GHSA-xxjr-mmjv-4gpg","Warn: Project is vulnerable to: GHSA-r5fr-rjxr-66jc","Warn: Project is vulnerable to: GHSA-38c4-r59v-3vqw","Warn: Project is vulnerable to: GHSA-6v5v-wf23-fmfq","Warn: Project is vulnerable to: GHSA-4fh9-h7wg-q85m","Warn: Project is vulnerable to: GHSA-23c5-xmqv-rm74","Warn: Project is vulnerable to: GHSA-3ppc-4f35-3m26","Warn: Project is vulnerable to: GHSA-7r86-cg39-jmmj","Warn: Project is vulnerable to: GHSA-2328-f5f3-gj25","Warn: Project is vulnerable to: GHSA-554w-wpv2-vw27","Warn: Project is vulnerable to: GHSA-5gfm-wpxj-wjgq","Warn: Project is vulnerable to: GHSA-5m6q-g25r-mvwx","Warn: Project is vulnerable to: GHSA-65ch-62r8-g69g","Warn: Project is vulnerable to: GHSA-ppp5-5v6c-4jwp","Warn: Project is vulnerable to: GHSA-q67f-28xg-22rw","Warn: Project is vulnerable to: GHSA-37ch-88jc-xwx2","Warn: Project is vulnerable to: GHSA-27v5-c462-wpq7","Warn: Project is vulnerable to: GHSA-j3q9-mxjg-w52f","Warn: Project is vulnerable to: GHSA-3v7f-55p6-f55p","Warn: Project is vulnerable to: GHSA-c2c7-rcm5-vvqj","Warn: Project is vulnerable to: GHSA-r28c-9q8g-f849","Warn: Project is vulnerable to: GHSA-36hm-qxxp-pg3m","Warn: Project is vulnerable to: GHSA-6rw7-vpxm-498p","Warn: Project is vulnerable to: GHSA-q8mj-m7cp-5q26","Warn: Project is vulnerable to: GHSA-w7fw-mjwx-w883","Warn: Project is vulnerable to: GHSA-5c6j-r48x-rmvq","Warn: Project is vulnerable to: GHSA-qj8w-gfj5-8c6v","Warn: Project is vulnerable to: GHSA-f88m-g3jw-g9cj","Warn: Project is vulnerable to: GHSA-395f-4hp3-45gv","Warn: Project is vulnerable to: GHSA-w7jw-789q-3m8p","Warn: Project is vulnerable to: GHSA-v3rj-xjv7-4jmq","Warn: Project is vulnerable to: GHSA-vj76-c3g6-qr5v","Warn: Project is vulnerable to: GHSA-ph9p-34f9-6g65","Warn: Project is vulnerable to: GHSA-qpx9-hpmf-5gmw","Warn: Project is vulnerable to: GHSA-35p6-xmwp-9g52","Warn: Project is vulnerable to: GHSA-g8m3-5g58-fq7m","Warn: Project is vulnerable to: GHSA-p88m-4jfj-68fv","Warn: Project is vulnerable to: GHSA-vxpw-j846-p89q","Warn: Project is vulnerable to: GHSA-hm92-r4w5-c3mj","Warn: Project is vulnerable to: GHSA-pr7r-676h-xcf6","Warn: Project is vulnerable to: GHSA-vmh5-mc38-953g","Warn: Project is vulnerable to: GHSA-w5hq-g745-h8pq","Warn: Project is vulnerable to: GHSA-4w7w-66w2-5vf9","Warn: Project is vulnerable to: GHSA-93m4-6634-74q7","Warn: Project is vulnerable to: GHSA-fx2h-pf6j-xcff","Warn: Project is vulnerable to: GHSA-38r7-794h-5758","Warn: Project is vulnerable to: GHSA-8fgc-7cc6-rx7x","Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v","Warn: Project is vulnerable to: GHSA-79cf-xcqc-c78w","Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h","Warn: Project is vulnerable to: GHSA-f5vj-f2hx-8m93","Warn: Project is vulnerable to: GHSA-m28w-2pqf-7qgj","Warn: Project is vulnerable to: GHSA-mx8g-39q3-5c79","Warn: Project is vulnerable to: GHSA-mp7j-qc5w-4988","Warn: Project is vulnerable to: GHSA-xv26-6w52-cph6","Warn: Project is vulnerable to: GHSA-58qx-3vcg-4xpx","Warn: Project is vulnerable to: GHSA-96hv-2xvq-fx4p","Warn: Project is vulnerable to: GHSA-48c2-rrv3-qjmp"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#vulnerabilities"}},{"name":"CI-Tests","score":10,"reason":"9 out of 9 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#ci-tests"}},{"name":"Contributors","score":10,"reason":"project has 10 contributing companies or organizations","details":["Info: found contributions from: Mermaid-Chart, argoproj, fossgect, garnercorp, gecthrissur, mermaid-chart, mermaid-js, ringcentral, san-diego-tech-hub, wattfox"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#contributors"}}]}