{"date":"2026-10-08T07:37:02Z","repo":{"name":"github.com/topoteretes/cognee","commit":"0ec7a9fa61c9ff04bf7e02e0d57af363a993a5e1"},"scorecard":{"version":"v5.5.0","commit":"c395761df6afe1a69e476bc60a013a94bcbc153f"},"score":6.9,"checks":[{"name":"Code-Review","score":4,"reason":"Found 6/13 approved changesets -- score normalized to 4","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review","short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged."}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy","short":"Determines if the project has published a security policy."}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained","short":"Determines if the project is \"actively maintained\"."}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool","short":"Determines if the project uses a dependency update tool."}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow","short":"Determines if the project's GitHub Action workflows avoid dangerous patterns."}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts","short":"Determines if the project has generated executable (binary) artifacts in the source repository."}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/dev_canary_release.yml:131","Info: jobLevel 'contents' permission set to 'read': .github/workflows/dev_canary_release.yml:70","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docs_issue_triage.yml:178","Info: jobLevel 'contents' permission set to 'read': .github/workflows/label-core-team.yml:22","Info: jobLevel 'contents' permission set to 'read': .github/workflows/mirror-images.yml:24","Info: jobLevel 'contents' permission set to 'read': .github/workflows/nightly_scheduler.yml:58","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/nightly_scheduler.yml:61","Warn: jobLevel 'statuses' permission set to 'write': .github/workflows/pr_lint.yml:20","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:17","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:111","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:194","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:293","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yml:414","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release_mcp.yml:35","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release_test.yml:367","Warn: jobLevel 'packages' permission set to 'write': .github/workflows/release_test.yml:368","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/router_docstring_sync.yml:58","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/router_docstring_sync.yml:209","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/spec_extras_sync.yml:95","Info: jobLevel 'contents' permission set to 'read': .github/workflows/telemetry-insights.yml:42","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/telemetry-insights.yml:44","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test_suites.yml:363","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test_suites.yml:32","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/update-contributors.yml:17","Info: topLevel 'contents' permission set to 'read': .github/workflows/adapter_caching_tests.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/adapter_caching_tests.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/approve_dco.yaml:8","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/approve_dco.yaml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/backend_docker_build_test.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/backend_docker_build_test.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/basic_tests.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/basic_tests.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/catalog.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/clean_stale_pr.yaml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/cli_tests.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/cli_tests.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/community_greetings.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/community_tests.yml:13","Info: topLevel 'packages' permission set to 'read': .github/workflows/dev_canary_release.yml:19","Info: topLevel 'contents' permission set to 'read': .github/workflows/dev_canary_release.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/dev_previous_day_commits.yml:18","Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/dev_previous_day_commits.yml:19","Info: topLevel 'contents' permission set to 'read': .github/workflows/docker_compose.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/docker_validation_nightly.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/dockerhub-mcp.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/dockerhub-ui.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/dockerhub.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/docs_issue_triage.yml:68","Info: topLevel 'contents' permission set to 'read': .github/workflows/e2e_tests.yml:3","Info: topLevel 'packages' permission set to 'read': .github/workflows/e2e_tests.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/examples_tests.yml:12","Info: topLevel 'packages' permission set to 'read': .github/workflows/examples_tests.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/frontend_docker_build_test.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/graph_db_tests.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/graph_db_tests.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/helm-ci.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/integration_tests.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/integration_tests.yml:5","Warn: no topLevel permission defined: .github/workflows/journey_tests.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/label-core-team.yml:15","Info: topLevel 'contents' permission set to 'read': .github/workflows/load_tests.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/load_tests.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/mirror-images.yml:19","Info: topLevel 'contents' permission set to 'read': .github/workflows/nightly_scheduler.yml:45","Info: topLevel 'contents' permission set to 'read': .github/workflows/nightly_tests.yml:7","Info: topLevel 'packages' permission set to 'read': .github/workflows/nightly_tests.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/notebooks_tests.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/notebooks_tests.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/performance_report.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/performance_report.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/performance_report_cloud.yml:74","Info: topLevel 'contents' permission set to 'read': .github/workflows/performance_report_rust.yml:60","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr_lint.yml:14","Info: topLevel 'contents' permission set to 'read': .github/workflows/pre_test.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/relational_db_migration_tests.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/relational_db_migration_tests.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/release_discord_action.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/release_mcp.yml:29","Info: topLevel 'contents' permission set to 'read': .github/workflows/release_test.yml:11","Info: topLevel 'packages' permission set to 'read': .github/workflows/release_test.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/require-linear-issue.yml:19","Info: topLevel 'contents' permission set to 'read': .github/workflows/reusable_notebook.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/reusable_notebook.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/router_docstring_sync.yml:47","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18","Info: topLevel 'contents' permission set to 'read': .github/workflows/search_db_tests.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/search_db_tests.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/skills_link_check.yml:23","Info: topLevel 'contents' permission set to 'read': .github/workflows/slow_e2e_tests.yml:3","Info: topLevel 'packages' permission set to 'read': .github/workflows/slow_e2e_tests.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/spec_extras_sync.yml:79","Info: topLevel 'contents' permission set to 'read': .github/workflows/sync_mintlify_docs.yml:25","Info: topLevel 'contents' permission set to 'read': .github/workflows/telemetry-insights.yml:33","Info: topLevel 'contents' permission set to 'read': .github/workflows/temporal_graph_tests.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/temporal_graph_tests.yml:5","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_deployment_mcp.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_different_operating_systems.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_llamacpp.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/test_llamacpp.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_llms.yml:4","Info: topLevel 'packages' permission set to 'read': .github/workflows/test_llms.yml:5","Info: topLevel 'packages' permission set to 'read': .github/workflows/test_mcp.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_mcp.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_ollama.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/test_ollama.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_s3_file_storage.yml:12","Info: topLevel 'packages' permission set to 'read': .github/workflows/test_s3_file_storage.yml:13","Info: topLevel 'contents' permission set to 'read': .github/workflows/test_suites.yml:3","Info: topLevel 'packages' permission set to 'read': .github/workflows/test_suites.yml:4","Info: topLevel 'contents' permission set to 'read': .github/workflows/update-contributors.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/vector_db_tests.yml:8","Info: topLevel 'packages' permission set to 'read': .github/workflows/vector_db_tests.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/weekly-ticket-proposals.yml:25"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions","short":"Determines if the project's workflows follow the principle of least privilege."}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices","short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge."}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license","short":"Determines if the project has defined a license."}},{"name":"Pinned-Dependencies","score":8,"reason":"dependency not pinned by hash detected -- score normalized to 8","details":["Info: Possibly incomplete results: error parsing job operating system: .github/workflows/test_different_operating_systems.yml:728","Info: Possibly incomplete results: error parsing job operating system: .github/workflows/test_different_operating_systems.yml:637","Info: Possibly incomplete results: error parsing job operating system: .github/workflows/test_different_operating_systems.yml:680","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/approve_dco.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/approve_dco.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/clean_stale_pr.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/clean_stale_pr.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/clean_stale_pr.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/clean_stale_pr.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr_lint.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/pr_lint.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr_lint.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/pr_lint.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:150: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:139: update your workflow using https://app.stepsecurity.io/secureworkflow/topoteretes/cognee/weekly-ticket-proposals.yml/main?enable=pin","Warn: containerImage not pinned by hash: evals/old/hotpot_qa_24_2025/src/modal_apps/Dockerfile.neo4j-custom:3: pin your Docker image by updating python:3.11-slim-bookworm to python:3.11-slim-bookworm@sha256:0a310eeecf4e1f5a0743f9a6520c90c88d089c903ca5fd283f501e3a805f5f89","Warn: containerImage not pinned by hash: evals/old/hotpot_qa_24_2025/src/modal_apps/Dockerfile.neo4j-custom:18: pin your Docker image by updating python:3.11-slim-bookworm to python:3.11-slim-bookworm@sha256:0a310eeecf4e1f5a0743f9a6520c90c88d089c903ca5fd283f501e3a805f5f89","Warn: pipCommand not pinned by hash: evals/old/hotpot_qa_24_2025/src/modal_apps/Dockerfile.neo4j-custom:76","Warn: pipCommand not pinned by hash: deployment/setup_ubuntu_instance.sh:29","Warn: pipCommand not pinned by hash: .github/workflows/nightly_tests.yml:367","Warn: downloadThenRun not pinned by hash: .github/workflows/release.yml:325","Warn: pipCommand not pinned by hash: .github/workflows/telemetry-insights.yml:60","Warn: npmCommand not pinned by hash: .github/workflows/telemetry-insights.yml:81","Warn: pipCommand not pinned by hash: .github/workflows/test_deployment_mcp.yml:41","Warn: pipCommand not pinned by hash: .github/workflows/test_deployment_mcp.yml:42","Warn: pipCommand not pinned by hash: .github/workflows/test_mcp.yml:44","Warn: pipCommand not pinned by hash: .github/workflows/test_mcp.yml:45","Warn: pipCommand not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:37","Warn: npmCommand not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:60","Warn: npmCommand not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:98","Warn: pipCommand not pinned by hash: .github/workflows/weekly-ticket-proposals.yml:99","Info: 214 out of 228 GitHub-owned GitHubAction dependencies pinned","Info:  78 out of  80 third-party GitHubAction dependencies pinned","Info:  11 out of  13 containerImage dependencies pinned","Info:   1 out of   4 npmCommand dependencies pinned","Info:   0 out of  10 pipCommand dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies","short":"Determines if the project has declared and pinned the dependencies of its build process."}},{"name":"SAST","score":7,"reason":"SAST tool is not run on all commits -- score normalized to 7","details":["Warn: 21 commits out of 30 are checked with a SAST tool"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast","short":"Determines if the project uses static code analysis."}},{"name":"Signed-Releases","score":10,"reason":"5 out of the last 5 releases have a total of 10 signed artifacts.","details":["Info: signed release artifact: cognee-1.6.3.sigstore.json: https://github.com/topoteretes/cognee/releases/tag/v1.6.3","Info: signed release artifact: cognee-1.6.2.sigstore.json: https://github.com/topoteretes/cognee/releases/tag/v1.6.2","Info: signed release artifact: cognee-1.6.1.sigstore.json: https://github.com/topoteretes/cognee/releases/tag/v1.6.1","Info: signed release artifact: cognee-1.6.0.sigstore.json: https://github.com/topoteretes/cognee/releases/tag/v1.6.0","Info: signed release artifact: cognee-1.5.4rc1.sigstore.json: https://github.com/topoteretes/cognee/releases/tag/v1.5.4rc1","Info: provenance for release artifact: cognee-1.6.3.intoto.jsonl: https://github.com/topoteretes/cognee/releases/tag/v1.6.3","Info: provenance for release artifact: cognee-1.6.2.intoto.jsonl: https://github.com/topoteretes/cognee/releases/tag/v1.6.2","Info: provenance for release artifact: cognee-1.6.1.intoto.jsonl: https://github.com/topoteretes/cognee/releases/tag/v1.6.1","Info: provenance for release artifact: cognee-1.6.0.intoto.jsonl: https://github.com/topoteretes/cognee/releases/tag/v1.6.0","Info: provenance for release artifact: cognee-1.5.4rc1.intoto.jsonl: https://github.com/topoteretes/cognee/releases/tag/v1.5.4rc1"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases","short":"Determines if the project cryptographically signs release artifacts."}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing","short":"Determines if the project uses fuzzing."}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/dev_canary_release.yml:63"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging","short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall."}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection","short":"Determines if the default and release branches are protected with GitHub's branch protection settings."}},{"name":"Vulnerabilities","score":0,"reason":"82 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: https://osv.dev/GHSA-4x5r-pxfx-6jf8","Warn: Project is vulnerable to: https://osv.dev/GHSA-2g4f-4pwh-qvx6","Warn: Project is vulnerable to: https://osv.dev/GHSA-6j4f-fj2g-mc7p","Warn: Project is vulnerable to: https://osv.dev/GHSA-q2hr-2g5m-vwhr","Warn: Project is vulnerable to: https://osv.dev/GHSA-qhr7-859c-m2p7","Warn: Project is vulnerable to: https://osv.dev/GHSA-vfj7-8cjw-p6xm","Warn: Project is vulnerable to: https://osv.dev/GHSA-2883-xcg3-v3hh","Warn: Project is vulnerable to: https://osv.dev/GHSA-52cp-r559-cp3m","Warn: Project is vulnerable to: https://osv.dev/GHSA-5p4m-2wfm-xmqj","Warn: Project is vulnerable to: https://osv.dev/GHSA-h67p-54hq-rp68","Warn: Project is vulnerable to: https://osv.dev/GHSA-23c5-xmqv-rm74","Warn: Project is vulnerable to: https://osv.dev/GHSA-3ppc-4f35-3m26","Warn: Project is vulnerable to: https://osv.dev/GHSA-7r86-cg39-jmmj","Warn: Project is vulnerable to: https://osv.dev/GHSA-39w2-rjm5-chcv","Warn: Project is vulnerable to: https://osv.dev/GHSA-3w37-wq28-93x7","Warn: Project is vulnerable to: https://osv.dev/GHSA-4jqv-mc3x-m676","Warn: Project is vulnerable to: https://osv.dev/GHSA-cjq9-62q9-8jv4","Warn: Project is vulnerable to: https://osv.dev/GHSA-f87g-xv8r-7p7x","Warn: Project is vulnerable to: https://osv.dev/GHSA-mcj8-r9mp-w47p","Warn: Project is vulnerable to: https://osv.dev/GHSA-vcvr-r3jv-pc5j","Warn: Project is vulnerable to: https://osv.dev/GHSA-3v7f-55p6-f55p","Warn: Project is vulnerable to: https://osv.dev/GHSA-c2c7-rcm5-vvqj","Warn: Project is vulnerable to: https://osv.dev/GHSA-wq5f-xc86-pv6w","Warn: Project is vulnerable to: https://osv.dev/GHSA-68fv-2mgg-jv7q","Warn: Project is vulnerable to: https://osv.dev/GHSA-hp3w-g68c-fv3c","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-3804","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4023","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4024","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4025","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2447","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4066","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-87","Warn: Project is vulnerable to: https://osv.dev/GHSA-5639-2j2p-m4mx","Warn: Project is vulnerable to: https://osv.dev/GHSA-54p9-h82j-f925","Warn: Project is vulnerable to: https://osv.dev/GHSA-8mgp-746c-j5xp","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4140","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4141","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4142","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4143","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4144","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4145","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4146","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4147","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4148","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4149","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4150","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4151","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4152","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4183","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4153","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4154","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4155","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4156","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4157","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4158","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4159","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4160","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-1845","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4170","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4171","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2025-217","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2288","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2289","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-2290","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-3929","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4174","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-3930","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4175","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4176","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4177","Warn: Project is vulnerable to: https://osv.dev/GHSA-3cr3-8m4c-fpxw","Warn: Project is vulnerable to: https://osv.dev/GHSA-9jxx-vjrv-h2rq","Warn: Project is vulnerable to: https://osv.dev/GHSA-cgc7-9qp3-86m3","Warn: Project is vulnerable to: https://osv.dev/GHSA-p3fw-7699-7926","Warn: Project is vulnerable to: https://osv.dev/GHSA-p944-4xh2-x776","Warn: Project is vulnerable to: https://osv.dev/GHSA-pc36-qwjq-x68c","Warn: Project is vulnerable to: https://osv.dev/GHSA-x3q2-h9hx-4r4j","Warn: Project is vulnerable to: https://osv.dev/GHSA-27vj-qcqg-25rc","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-77","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4113","Warn: Project is vulnerable to: https://osv.dev/PYSEC-2026-4114","Warn: Project is vulnerable to: https://osv.dev/GHSA-g6x2-hccm-hh4m"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities","short":"Determines if the project has open, known unfixed vulnerabilities."}},{"name":"CI-Tests","score":10,"reason":"13 out of 13 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests","short":"Determines if the project runs tests before pull requests are merged."}},{"name":"Contributors","score":10,"reason":"project has 10 contributing companies or organizations","details":["Info: found contributions from: BmoIsMo, DepressivnieSmewnie, Dolla-LTD, bead, cognee, django-commons, guerrilla dev, oceanpact, staff software engineer @ stackadapt, topoteretes"],"documentation":{"url":"https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors","short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies)."}}]}