{"date":"2026-08-24","repo":{"name":"github.com/mongodb/mongo","commit":"a771424c0a92e34369b05674f5752dc9457c6aa2"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":4.7,"checks":[{"name":"Code-Review","score":0,"reason":"Found 0/30 approved changesets -- score normalized to 0","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":2,"reason":"badge detected: InProgress","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE-Community.txt:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Branch-Protection","score":3,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'master'","Info: 'force pushes' disabled on branch 'master'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'master'","Warn: branch 'master' does not require approvers","Warn: codeowners review is not required on branch 'master'","Warn: no status checks found to merge onto branch 'master'","Warn: PRs are not required to make changes on branch 'master'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:69","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:82","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:116","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:119","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/control_flow_test.cc:301","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/control_flow_test.cc:312","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/control_flow_test.cc:313","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/coverage_test.cc:207","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/coverage_test.cc:220","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/runner.cc:459","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/runner_main.cc:19","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/fuzztest/llvm_fuzzer_wrapper.cc:32","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/fuzztest/llvm_fuzzer_wrapper.cc:206","Info: CppLibFuzzer integration found: src/third_party/grpc/dist/third_party/utf8_range/fuzz/utf8_validity_fuzzer.cc:11","Info: CppLibFuzzer integration found: src/third_party/json-c/dist/fuzz/tokener_parse_ex_fuzzer.cc:5","Info: CppLibFuzzer integration found: src/third_party/protobuf/dist/third_party/utf8_range/fuzz/utf8_validity_fuzzer.cc:11","Info: CppLibFuzzer integration found: src/third_party/re2/dist/re2/fuzzing/re2_fuzzer.cc:241","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/central_freelist_fuzz.cc:145","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/experiment_fuzz.cc:22","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/huge_page_aware_allocator_fuzz.cc:64","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/huge_page_filler_fuzz.cc:99","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/internal/profile_builder_fuzz.cc:25","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/internal/sysinfo_fuzz.cc:23","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/malloc_extension_fuzz.cc:25","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/sizemap_fuzz.cc:31","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/span_fuzz.cc:35","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/transfer_cache_fuzz.cc:86","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:69","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:82","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:116","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/analyze_corpora_test.cc:119","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/control_flow_test.cc:301","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/control_flow_test.cc:312","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/control_flow_test.cc:313","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/coverage_test.cc:207","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/coverage_test.cc:220","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/runner.cc:459","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/centipede/runner_main.cc:19","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/fuzztest/llvm_fuzzer_wrapper.cc:32","Info: CppLibFuzzer integration found: src/third_party/fuzztest/dist/fuzztest/llvm_fuzzer_wrapper.cc:206","Info: CppLibFuzzer integration found: src/third_party/grpc/dist/third_party/utf8_range/fuzz/utf8_validity_fuzzer.cc:11","Info: CppLibFuzzer integration found: src/third_party/json-c/dist/fuzz/tokener_parse_ex_fuzzer.cc:5","Info: CppLibFuzzer integration found: src/third_party/protobuf/dist/third_party/utf8_range/fuzz/utf8_validity_fuzzer.cc:11","Info: CppLibFuzzer integration found: src/third_party/re2/dist/re2/fuzzing/re2_fuzzer.cc:241","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/central_freelist_fuzz.cc:145","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/experiment_fuzz.cc:22","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/huge_page_aware_allocator_fuzz.cc:64","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/huge_page_filler_fuzz.cc:99","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/internal/profile_builder_fuzz.cc:25","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/internal/sysinfo_fuzz.cc:23","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/malloc_extension_fuzz.cc:25","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/sizemap_fuzz.cc:31","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/span_fuzz.cc:35","Info: CppLibFuzzer integration found: src/third_party/tcmalloc/dist/tcmalloc/transfer_cache_fuzz.cc:86","Info: CppLibFuzzer integration found: src/mongo/bson/bson_validate_fuzzer.cpp:13","Info: CppLibFuzzer integration found: src/mongo/bson/column/bson_column_validate_fuzzer.cpp:13","Info: CppLibFuzzer integration found: src/mongo/bson/column/bsoncolumn_builder_fuzzer.cpp:27","Info: CppLibFuzzer integration found: src/mongo/bson/column/bsoncolumn_decompress_fuzzer.cpp:17","Info: CppLibFuzzer integration found: src/mongo/bson/column/bsoncolumn_decompress_paths_fuzzer.cpp:118","Info: CppLibFuzzer integration found: src/mongo/bson/column/bsoncolumnbuilder_reopen_fuzzer.cpp:7","Info: CppLibFuzzer integration found: src/mongo/bson/column/simple8b_fuzzer.cpp:22","Info: CppLibFuzzer integration found: src/mongo/bson/fromjson_fuzzer.cpp:32","Info: CppLibFuzzer integration found: src/mongo/db/exec/convert_string_to_object_fuzzer.cpp:35","Info: CppLibFuzzer integration found: src/mongo/db/op_msg_fuzzer_router.cpp:8","Info: CppLibFuzzer integration found: src/mongo/db/op_msg_fuzzer_shard.cpp:8","Info: CppLibFuzzer integration found: src/mongo/db/query/datetime/date_time_support_fuzzer.cpp:11","Info: CppLibFuzzer integration found: src/mongo/db/storage/key_string/key_string_to_bson_fuzzer.cpp:39","Info: CppLibFuzzer integration found: src/mongo/rpc/protocol_fuzzer.cpp:84","Info: CppLibFuzzer integration found: src/third_party/boost/libs/algorithm/minmax/fuzzing/minmax_element.fuzz.cpp:26","Info: CppLibFuzzer integration found: src/third_party/boost/libs/algorithm/minmax/fuzzing/minmax_element_variants.fuzz.cpp:30","Info: CppLibFuzzer integration found: src/third_party/boost/libs/locale/fuzzing/fuzz_scientific_to_int.cpp:14","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/fuzzing/keyring_g10.cpp:35","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/fuzzing/keyring_g10.cpp:37","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/fuzzing/keyring_g10.cpp:40","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:31","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:40","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:45","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:50","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:54","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:57","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:60","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_dump.cpp:63","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:31","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:38","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:41","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:44","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:47","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:50","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:53","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyimport.cpp:56","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring.cpp:31","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring.cpp:39","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring.cpp:42","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring.cpp:46","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring.cpp:50","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring.cpp:53","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_g10.cpp:31","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_g10.cpp:38","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_g10.cpp:41","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_g10.cpp:44","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_kbx.cpp:31","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_kbx.cpp:38","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_kbx.cpp:43","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_kbx.cpp:47","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_kbx.cpp:51","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_keyring_kbx.cpp:55","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_sigimport.cpp:31","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_sigimport.cpp:39","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify.cpp:32","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify.cpp:39","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify.cpp:42","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify.cpp:45","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify.cpp:48","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify_detached.cpp:32","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify_detached.cpp:40","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify_detached.cpp:43","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify_detached.cpp:46","Info: CppLibFuzzer integration found: src/third_party/rnp/dist/src/tests/fuzz_verify_detached.cpp:49"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: src/third_party/wiredtiger/tools/voidstar/lib/libvoidstar.so:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Pinned-Dependencies","score":3,"reason":"dependency not pinned by hash detected -- score normalized to 3","details":["Info: Possibly incomplete results: error parsing shell code: \"[x]\" must be followed by =: src/third_party/wiredtiger/test/format/format.sh:0","Warn: containerImage not pinned by hash: .devcontainer/Dockerfile:3","Warn: containerImage not pinned by hash: bazel/hermetic_container/Dockerfile.hermetic_container:1: pin your Docker image by updating debian:buster-slim to debian:buster-slim@sha256:bb3dc79fddbca7e8903248ab916bb775c96ec61014b3d02b4f06043b604726dc","Warn: containerImage not pinned by hash: buildscripts/antithesis/base_images/mongo_binaries/Dockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: containerImage not pinned by hash: buildscripts/antithesis/base_images/workload/Dockerfile:1: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc","Warn: pipCommand not pinned by hash: .devcontainer/Dockerfile:134-138","Warn: pipCommand not pinned by hash: .devcontainer/Dockerfile:134-138","Warn: pipCommand not pinned by hash: buildscripts/antithesis/base_images/workload/Dockerfile:42","Warn: pipCommand not pinned by hash: buildscripts/antithesis/base_images/workload/Dockerfile:98","Warn: downloadThenRun not pinned by hash: buildscripts/build_cargo_bazel_ppc64le.sh:33","Warn: downloadThenRun not pinned by hash: buildscripts/mongo_rg_builds/build_rg_macos_universal.sh:16","Warn: npmCommand not pinned by hash: buildscripts/sbom/install_endorctl.sh:64","Warn: pipCommand not pinned by hash: evergreen/generate_sast_report.sh:14","Warn: downloadThenRun not pinned by hash: evergreen/streams_build_js_engine.sh:82","Warn: downloadThenRun not pinned by hash: evergreen/streams_build_js_engine.sh:92","Warn: downloadThenRun not pinned by hash: evergreen/streams_build_js_engine.sh:102","Warn: npmCommand not pinned by hash: jstests/third_party/fast_check/4.6.0/import.sh:16","Warn: downloadThenRun not pinned by hash: src/mongo/scripting/mozjs/wasm/scripts/build_spidermonkey_wasip2.sh:62","Warn: npmCommand not pinned by hash: src/mongo/shell/debugger/vscode/install.sh:15","Warn: downloadThenRun not pinned by hash: src/third_party/rnp/dist/ci-legacy/lib/install_functions.inc.sh:755","Warn: pipCommand not pinned by hash: src/third_party/wiredtiger/test/evergreen/code_coverage_analysis.sh:33","Warn: pipCommand not pinned by hash: src/third_party/wiredtiger/test/evergreen/coverage-report.sh:42","Warn: pipCommand not pinned by hash: src/third_party/wiredtiger/test/evergreen/cyclomatic-complexity.sh:34","Warn: pipCommand not pinned by hash: src/third_party/wiredtiger/test/evergreen/ensure_swig_version.sh:24","Info:   1 out of   4 npmCommand dependencies pinned","Info:  13 out of  17 containerImage dependencies pinned","Info:   0 out of   9 pipCommand dependencies pinned","Info:   0 out of   7 downloadThenRun dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}}]}