{"date":"2026-10-17T05:20:21Z","repo":{"name":"github.com/openmeterio/openmeter","commit":"3e90e1a9c0980feb154f523ba7c8e2e161a7c777"},"scorecard":{"version":"v5.5.0","commit":"c395761df6afe1a69e476bc60a013a94bcbc153f"},"score":7.2,"checks":[{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yaml:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool","short":"Determines if the project uses a dependency update tool."}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Token-Permissions","score":9,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/analysis-scorecard.yaml:19","Info: jobLevel 'contents' permission set to 'read': .github/workflows/analysis-scorecard.yaml:20","Info: jobLevel 'contents' permission set to 'read': .github/workflows/benthos-collector.yaml:14","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/benthos-collector.yaml:15","Info: jobLevel 'contents' permission set to 'read': .github/workflows/benthos-collector.yaml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/benthos-collector.yaml:57","Info: jobLevel 'contents' permission set to 'read': .github/workflows/cancel-stale-pr-runs.yaml:13","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/cancel-stale-pr-runs.yaml:14","Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci.yaml:16","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/ci.yaml:17","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:50","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/codeql.yml:51","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:57","Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql.yml:59","Info: jobLevel 'contents' permission set to 'read': .github/workflows/container-tests.yaml:16","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/container-tests.yaml:17","Info: jobLevel 'contents' permission set to 'read': .github/workflows/container-tests.yaml:27","Info: jobLevel 'contents' permission set to 'read': .github/workflows/container-tests.yaml:113","Info: jobLevel 'contents' permission set to 'read': .github/workflows/container-tests.yaml:172","Info: jobLevel 'contents' permission set to 'read': .github/workflows/nix.yaml:20","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/nix.yaml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-checks.yaml:16","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/pr-checks.yaml:17","Warn: jobLevel 'checks' permission set to 'write': .github/workflows/pr-checks.yaml:53","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-aip-npm.yaml:38","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/release-docker.yaml:22","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-docker.yaml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-docker.yaml:81","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/release-docker.yaml:82","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-go-sdk.yaml:34","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-npm.yaml:37","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yaml:257","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yaml:273","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yaml:26","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/release.yaml:27","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yaml:182","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/security.yaml:41","Info: jobLevel 'issues' permission set to 'read': .github/workflows/security.yaml:42","Warn: jobLevel 'checks' permission set to 'write': .github/workflows/security.yaml:43","Info: topLevel 'contents' permission set to 'read': .github/workflows/analysis-scorecard.yaml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/benthos-collector.yaml:7","Info: found token with 'none' permissions: .github/workflows/cancel-stale-pr-runs.yaml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yaml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql-go.yaml:27","Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql-go.yaml:28","Info: topLevel 'packages' permission set to 'read': .github/workflows/codeql-go.yaml:29","Info: found token with 'none' permissions: .github/workflows/codeql.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/container-tests.yaml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/fossa.yaml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/nix.yaml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr-checks.yaml:7","Info: topLevel 'actions' permission set to 'read': .github/workflows/pr-checks.yaml:8","Info: topLevel 'checks' permission set to 'read': .github/workflows/pr-checks.yaml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-aip-npm.yaml:25","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-docker.yaml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-go-sdk.yaml:25","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-npm.yaml:24","Info: topLevel 'contents' permission set to 'read': .github/workflows/release-sdk-python-dev.yaml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yaml:15","Info: topLevel 'contents' permission set to 'read': .github/workflows/security.yaml:2","Info: topLevel 'actions' permission set to 'read': .github/workflows/security.yaml:3","Info: topLevel 'checks' permission set to 'read': .github/workflows/security.yaml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/stale-pull-requests.yaml:9"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Pinned-Dependencies","score":9,"reason":"dependency not pinned by hash detected -- score normalized to 9","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/benthos-collector.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/benthos-collector.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/ci.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/codeql.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/codeql.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/container-tests.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/container-tests.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/nix.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/nix.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-checks.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/pr-checks.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:252: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:268: update your workflow using https://app.stepsecurity.io/secureworkflow/openmeterio/openmeter/release.yaml/main?enable=pin","Info:  66 out of  66 GitHub-owned GitHubAction dependencies pinned","Info:  70 out of  78 third-party GitHubAction dependencies pinned","Info:   5 out of   5 containerImage dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"CI-Tests","score":-1,"reason":"internal error: internal error: Client.Repositories.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests","short":"Determines if the project runs tests before pull requests are merged."}},{"name":"SAST","score":-1,"reason":"internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `AikidoSec` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Vulnerabilities","score":0,"reason":"67 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: https://osv.dev/GHSA-3jxr-9vmj-r5cp","Warn: Project is vulnerable to: https://osv.dev/GHSA-6j4f-fj2g-mc7p","Warn: Project is vulnerable to: https://osv.dev/GHSA-mh99-v99m-4gvg","Warn: Project is vulnerable to: https://osv.dev/GHSA-q2hr-2g5m-vwhr","Warn: Project is vulnerable to: https://osv.dev/GHSA-qhr7-859c-m2p7","Warn: Project is vulnerable to: https://osv.dev/GHSA-rgw5-rvv9-x895","Warn: Project is vulnerable to: https://osv.dev/GHSA-g7r4-m6w7-qqqr","Warn: Project is vulnerable to: https://osv.dev/GHSA-58mr-gqgx-xq4g","Warn: Project is vulnerable to: https://osv.dev/GHSA-hrr3-gc8f-f4qj","Warn: Project is vulnerable to: https://osv.dev/GHSA-qw65-cvwx-89v3","Warn: Project is vulnerable to: https://osv.dev/GHSA-hmw2-7cc7-3qxx","Warn: Project is vulnerable to: https://osv.dev/GHSA-2883-xcg3-v3hh","Warn: Project is vulnerable to: https://osv.dev/GHSA-52cp-r559-cp3m","Warn: Project is vulnerable to: https://osv.dev/GHSA-5p4m-2wfm-xmqj","Warn: Project is vulnerable to: https://osv.dev/GHSA-h67p-54hq-rp68","Warn: Project is vulnerable to: https://osv.dev/GHSA-4w7w-66w2-5vf9","Warn: Project is vulnerable to: https://osv.dev/GHSA-fx2h-pf6j-xcff","Warn: Project is vulnerable to: https://osv.dev/GHSA-p9ff-h696-f583","Warn: Project is vulnerable to: https://osv.dev/GHSA-v2wj-q39q-566r","Warn: Project is vulnerable to: https://osv.dev/GHSA-v6wh-96g9-6wx3","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2104","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2105","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2106","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2107","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2108","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2109","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2110","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2111","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2112","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2113","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-237","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-3545","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-3546","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-3547","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-215","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4244","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2275","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-141","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-142","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4175","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4176","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4177","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2120","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2121","Warn: Project is vulnerable to: https://osv.dev/GHSA-2q42-4q24-7rgv","Warn: Project is vulnerable to: https://osv.dev/GHSA-82fw-gwwq-j7x9","Warn: Project is vulnerable to: https://osv.dev/GHSA-4q55-j62x-fr9h","Warn: Project is vulnerable to: https://osv.dev/GHSA-9rgm-9g3h-6x36","Warn: Project is vulnerable to: https://osv.dev/GHSA-hx4r-w6wj-j8fg","Warn: Project is vulnerable to: https://osv.dev/GHSA-j22f-vq7h-c4qm","Warn: Project is vulnerable to: https://osv.dev/GHSA-mcm9-63f2-9j32","Warn: Project is vulnerable to: https://osv.dev/GHSA-r9w8-h9r3-54w4","Warn: Project is vulnerable to: https://osv.dev/GHSA-wf3x-273g-mvxv","Warn: Project is vulnerable to: https://osv.dev/GHSA-x5rw-q4pp-hg5g","Warn: Project is vulnerable to: https://osv.dev/GHSA-5jgf-p345-68v8","Warn: Project is vulnerable to: https://osv.dev/GHSA-7p8r-x3mc-p8w7","Warn: Project is vulnerable to: https://osv.dev/GHSA-f65p-4m7j-42xc","Warn: Project is vulnerable to: https://osv.dev/GHSA-fph4-wmhf-6fwf","Warn: Project is vulnerable to: https://osv.dev/GHSA-jqff-g426-hqxp","Warn: Project is vulnerable to: https://osv.dev/GHSA-2v37-7h3g-55p8","Warn: Project is vulnerable to: https://osv.dev/GHSA-fxqj-rqcc-2cmp","Warn: Project is vulnerable to: https://osv.dev/GHSA-68fv-2mgg-jv7q","Warn: Project is vulnerable to: https://osv.dev/GO-2026-5046","Warn: Project is vulnerable to: https://osv.dev/GO-2026-5047","Warn: Project is vulnerable to: https://osv.dev/GO-2026-5048","Warn: Project is vulnerable to: https://osv.dev/GO-2026-6615","Warn: Project is vulnerable to: https://osv.dev/GO-2026-5932"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities","short":"Determines if the project has open, known unfixed vulnerabilities."}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v1.0.0-beta.236 not signed: https://api.github.com/repos/openmeterio/openmeter/releases/408008081","Warn: release artifact v1.0.0-beta.235 not signed: https://api.github.com/repos/openmeterio/openmeter/releases/401647026","Warn: release artifact v1.0.0-beta.234 not signed: https://api.github.com/repos/openmeterio/openmeter/releases/396748739","Warn: release artifact v1.0.0-beta.233 not signed: https://api.github.com/repos/openmeterio/openmeter/releases/391431473","Warn: release artifact v1.0.0-beta.232 not signed: https://api.github.com/repos/openmeterio/openmeter/releases/364968392","Warn: release artifact v1.0.0-beta.236 does not have provenance: https://api.github.com/repos/openmeterio/openmeter/releases/408008081","Warn: release artifact v1.0.0-beta.235 does not have provenance: https://api.github.com/repos/openmeterio/openmeter/releases/401647026","Warn: release artifact v1.0.0-beta.234 does not have provenance: https://api.github.com/repos/openmeterio/openmeter/releases/396748739","Warn: release artifact v1.0.0-beta.233 does not have provenance: https://api.github.com/repos/openmeterio/openmeter/releases/391431473","Warn: release artifact v1.0.0-beta.232 does not have provenance: https://api.github.com/repos/openmeterio/openmeter/releases/364968392"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Contributors","score":10,"reason":"project has 24 contributing companies or organizations","details":["Info: found contributions from: JSConfBp, Kong, NixOS, bank-vaults, banzaicloud, brewfactory, cisco-open, dexidp, emperror, go-viper, gofrs, guzzle, kong, kube-logging, logur, open-telemetry, openmeter, openmeterio, php-fig, php-http, portward, thephpleague, twirphp, vulncon"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors","short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies)."}}]}