{"date":"2026-08-17","repo":{"name":"github.com/vercel/next.js","commit":"c4d33a5cbbe7749a150b6a56ce7f6d9bd09b7445"},"scorecard":{"version":"v5.5.1-0.20260815060127-d1fab88f5463","commit":"d1fab88f54636ff366076edfc5c239f97b3c8e66"},"score":6.2,"checks":[{"name":"Code-Review","score":9,"reason":"Found 28/30 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: license.md:0","Info: FSF or OSI recognized license: MIT License: license.md:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/automated_code_review.yml:28","Info: jobLevel 'contents' permission set to 'read': .github/workflows/automated_code_review.yml:26","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_deploy.yml:260","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_deploy.yml:503","Info: found token with 'none' permissions: .github/workflows/build_and_deploy.yml:1","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_deploy.yml:139","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/build_and_deploy.yml:626","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:603","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:711","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:863","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:1082","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:32","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:322","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:333","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:573","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:760","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:896","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:89","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:350","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:484","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:1170","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:161","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:297","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:440","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:735","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:990","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:131","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:408","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:684","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:789","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:826","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:658","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:1018","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:1131","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:145","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:524","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:635","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:939","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:965","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:239","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:282","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:391","Info: jobLevel 'contents' permission set to 'read': .github/workflows/build_and_test.yml:1060","Info: jobLevel 'contents' permission set to 'read': .github/workflows/integration_tests_reusable.yml:49","Info: jobLevel 'contents' permission set to 'read': .github/workflows/integration_tests_reusable.yml:61","Info: jobLevel 'contents' permission set to 'read': .github/workflows/integration_tests_reusable.yml:102","Info: jobLevel 'contents' permission set to 'read': .github/workflows/integration_tests_reusable.yml:137","Info: jobLevel 'contents' permission set to 'read': .github/workflows/issue_reopen.yml:30","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pull_request_stats.yml:37","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pull_request_stats.yml:78","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pull_request_stats.yml:100","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-next-rspack.yml:44","Info: jobLevel 'contents' permission set to 'read': .github/workflows/rspack-nextjs-build-integration-tests.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/rspack-nextjs-dev-integration-tests.yml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/sync_backport_canary_release.yml:34","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/sync_backport_canary_release.yml:125","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test_e2e_deploy_release.yml:178","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test_e2e_deploy_release.yml:215","Info: jobLevel 'contents' permission set to 'read': .github/workflows/test_e2e_deploy_release.yml:268","Info: jobLevel 'contents' permission set to 'read': .github/workflows/turbopack-nextjs-build-integration-tests.yml:12","Info: jobLevel 'contents' permission set to 'read': .github/workflows/turbopack-nextjs-dev-integration-tests.yml:12","Info: jobLevel 'contents' permission set to 'read': .github/workflows/update_react.yml:26","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/update_react_poller.yml:17","Info: found token with 'none' permissions: .github/workflows/automated_code_review.yml:1","Warn: no topLevel permission defined: .github/workflows/build_and_deploy.yml:1","Warn: no topLevel permission defined: .github/workflows/build_and_test.yml:1","Warn: no topLevel permission defined: .github/workflows/build_reusable.yml:1","Warn: no topLevel permission defined: .github/workflows/code_freeze.yml:1","Warn: no topLevel permission defined: .github/workflows/create_release_branch.yml:1","Warn: no topLevel permission defined: .github/workflows/integration_tests_reusable.yml:1","Info: found token with 'none' permissions: .github/workflows/issue_reopen.yml:1","Warn: no topLevel permission defined: .github/workflows/issue_stale.yml:1","Warn: no topLevel permission defined: .github/workflows/issue_wrong_template.yml:1","Warn: no topLevel permission defined: .github/workflows/popular.yml:1","Info: topLevel 'actions' permission set to 'read': .github/workflows/pr_ci_comment.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/pr_ci_comment.yml:10","Warn: no topLevel permission defined: .github/workflows/pr_stack_optimizer.yml:1","Info: found token with 'none' permissions: .github/workflows/pull_request_auto_label.yml:1","Warn: no topLevel permission defined: .github/workflows/pull_request_stats.yml:1","Warn: no topLevel permission defined: .github/workflows/release-next-rspack.yml:1","Warn: topLevel 'actions' permission set to 'write': .github/workflows/retry_deploy_test.yml:13","Warn: topLevel 'actions' permission set to 'write': .github/workflows/retry_test.yml:16","Warn: no topLevel permission defined: .github/workflows/rspack-nextjs-build-integration-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/rspack-nextjs-dev-integration-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/rspack-update-tests-manifest.yml:1","Warn: no topLevel permission defined: .github/workflows/sync_backport_canary_release.yml:1","Warn: no topLevel permission defined: .github/workflows/test-turbopack-rust-bench-test.yml:1","Warn: no topLevel permission defined: .github/workflows/test_e2e_deploy_release.yml:1","Warn: no topLevel permission defined: .github/workflows/test_e2e_project_reset_cron.yml:1","Warn: no topLevel permission defined: .github/workflows/test_examples.yml:1","Warn: no topLevel permission defined: .github/workflows/trigger_release.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/turbopack-benchmark.yml:29","Warn: no topLevel permission defined: .github/workflows/turbopack-nextjs-build-integration-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/turbopack-nextjs-dev-integration-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/turbopack-update-tests-manifest.yml:1","Warn: no topLevel permission defined: .github/workflows/update_fonts_data.yml:1","Warn: no topLevel permission defined: .github/workflows/update_react.yml:1","Warn: no topLevel permission defined: .github/workflows/update_react_poller.yml:1","Warn: no topLevel permission defined: .github/workflows/upload-tests-manifest.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/upload_preview_tarballs.yml:14","Info: topLevel 'actions' permission set to 'read': .github/workflows/upload_preview_tarballs.yml:13"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/vercel/.github/SECURITY.md:1","Info: Found linked content: github.com/vercel/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/vercel/.github/SECURITY.md:1","Info: Found text in security policy: github.com/vercel/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release-next-rspack.yml:39"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection"}},{"name":"Binary-Artifacts","score":0,"reason":"binaries present in source code","details":["Warn: binary detected: examples/with-webassembly/add.wasm:1","Warn: binary detected: packages/next/next_error_code_swc_plugin.wasm:1","Warn: binary detected: packages/next/src/compiled/@mswjs/interceptors/ClientRequest/llhttp/llhttp.wasm:1","Warn: binary detected: packages/next/src/compiled/@vercel/og/resvg.wasm:1","Warn: binary detected: packages/next/src/compiled/@vercel/og/yoga.wasm:1","Warn: binary detected: packages/next/src/compiled/source-map08/mappings.wasm:1","Warn: binary detected: test/e2e/app-dir/webpack-loader-import-module/add.wasm:1","Warn: binary detected: test/e2e/app-dir/worker/app/add.wasm:1","Warn: binary detected: test/e2e/edge-can-use-wasm-files/add.wasm:1","Warn: binary detected: test/e2e/edge-runtime-dynamic-code/lib/square.wasm:1","Warn: binary detected: test/e2e/swc-plugins-env/swc_plugin_env_check.wasm:1","Warn: binary detected: test/production/app-dir-edge-runtime-with-wasm/add.wasm:1","Warn: binary detected: test/production/standalone-mode/tracing-unparsable/foo/binary:1","Warn: binary detected: test/production/turbopack-wasm-output-tracing/wasm-dep/add.wasm:1","Warn: binary detected: turbopack/crates/turbopack-tests/tests/execution/turbopack/wasm/module/input/add.wasm:1","Warn: binary detected: turbopack/crates/turbopack-tests/tests/execution/turbopack/wasm/simple/input/add.wasm:1","Warn: binary detected: turbopack/crates/turbopack-tests/tests/execution/turbopack/wasm/simple/input/factorial.wasm:1","Warn: binary detected: turbopack/crates/turbopack-tests/tests/execution/turbopack/wasm/simple/input/fibonacci.wasm:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: RustCargoFuzzer integration found: turbopack/crates/turbo-tasks-backend/fuzz/fuzz_targets/graph.rs:4"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing"}},{"name":"Pinned-Dependencies","score":4,"reason":"dependency not pinned by hash detected -- score normalized to 4","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/pull_request_auto_label.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/vercel/next.js/pull_request_auto_label.yml/canary?enable=pin","Warn: containerImage not pinned by hash: .github/actions/next-stats-action/Dockerfile:5: pin your Docker image by updating buildpack-deps:noble-scm to buildpack-deps:noble-scm@sha256:51323315f38d31c1b42b382911e655e0bc71257e38a3b99066b54d05af8b3e6d","Warn: containerImage not pinned by hash: .github/actions/next-stats-action/Dockerfile:13","Warn: containerImage not pinned by hash: .github/actions/next-stats-action/Dockerfile:22","Warn: containerImage not pinned by hash: .github/next-stats-action.Dockerfile:5: pin your Docker image by updating buildpack-deps:noble-scm to buildpack-deps:noble-scm@sha256:51323315f38d31c1b42b382911e655e0bc71257e38a3b99066b54d05af8b3e6d","Warn: containerImage not pinned by hash: .github/next-stats-action.Dockerfile:13","Warn: containerImage not pinned by hash: .github/next-stats-action.Dockerfile:23","Warn: containerImage not pinned by hash: examples/with-docker-compose/next-app/dev.Dockerfile:3: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293","Warn: containerImage not pinned by hash: examples/with-docker-compose/next-app/prod-without-multistage.Dockerfile:3: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293","Warn: containerImage not pinned by hash: examples/with-docker-compose/next-app/prod.Dockerfile:3: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293","Warn: containerImage not pinned by hash: examples/with-docker-compose/next-app/prod.Dockerfile:6","Warn: containerImage not pinned by hash: examples/with-docker-compose/next-app/prod.Dockerfile:48","Warn: containerImage not pinned by hash: examples/with-docker-export-output/Dockerfile:12: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker-export-output/Dockerfile:38: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker-export-output/Dockerfile:72: pin your Docker image by updating nginxinc/nginx-unprivileged:alpine3.22 to nginxinc/nginx-unprivileged:alpine3.22@sha256:5aea7cc516b419e3526f47dd1531be31a56a046cfe44754d94f9383e13e2ee99","Warn: containerImage not pinned by hash: examples/with-docker-export-output/Dockerfile.serve:10: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker-export-output/Dockerfile.serve:36: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker-export-output/Dockerfile.serve:71: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/development/Dockerfile:3: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/development/Dockerfile:6","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/development/Dockerfile:22","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/development/Dockerfile:31","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/production/Dockerfile:3: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/production/Dockerfile:6","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/production/Dockerfile:23","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/production/Dockerfile:32","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/staging/Dockerfile:3: pin your Docker image by updating node:20-alpine to node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/staging/Dockerfile:6","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/staging/Dockerfile:23","Warn: containerImage not pinned by hash: examples/with-docker-multi-env/docker/staging/Dockerfile:32","Warn: containerImage not pinned by hash: examples/with-docker/Dockerfile:10: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker/Dockerfile:36: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker/Dockerfile:74: pin your Docker image by updating node:24.13.0-slim to node:24.13.0-slim@sha256:4660b1ca8b28d6d1906fd644abe34b2ed81d15434d26d845ef0aced307cf4b6f","Warn: containerImage not pinned by hash: examples/with-docker/Dockerfile.bun:8: pin your Docker image by updating oven/bun:1 to oven/bun:1@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4","Warn: containerImage not pinned by hash: examples/with-docker/Dockerfile.bun:24: pin your Docker image by updating oven/bun:1 to oven/bun:1@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4","Warn: containerImage not pinned by hash: examples/with-docker/Dockerfile.bun:49: pin your Docker image by updating oven/bun:1 to oven/bun:1@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4","Warn: containerImage not pinned by hash: scripts/native-builder.Dockerfile:21: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: downloadThenRun not pinned by hash: .github/actions/next-stats-action/Dockerfile:7","Warn: npmCommand not pinned by hash: .github/actions/next-stats-action/Dockerfile:8","Warn: downloadThenRun not pinned by hash: .github/next-stats-action.Dockerfile:7","Warn: npmCommand not pinned by hash: .github/next-stats-action.Dockerfile:8","Warn: npmCommand not pinned by hash: examples/with-docker-export-output/Dockerfile.serve:78-79","Warn: downloadThenRun not pinned by hash: scripts/native-builder.Dockerfile:96-99","Warn: npmCommand not pinned by hash: scripts/native-builder.Dockerfile:112-118","Warn: downloadThenRun not pinned by hash: .devcontainer/rust/install.sh:5","Warn: npmCommand not pinned by hash: scripts/benchmark-boot-time.sh:59","Warn: downloadThenRun not pinned by hash: scripts/setup-node.sh:5","Warn: npmCommand not pinned by hash: .github/workflows/build_and_deploy.yml:162","Warn: downloadThenRun not pinned by hash: .github/workflows/build_and_deploy.yml:532","Warn: npmCommand not pinned by hash: .github/workflows/build_and_deploy.yml:68","Warn: npmCommand not pinned by hash: .github/workflows/build_and_deploy.yml:588","Warn: npmCommand not pinned by hash: .github/workflows/build_and_deploy.yml:638","Warn: npmCommand not pinned by hash: .github/workflows/build_and_test.yml:270","Warn: npmCommand not pinned by hash: .github/workflows/build_and_test.yml:185","Warn: npmCommand not pinned by hash: .github/workflows/code_freeze.yml:37","Warn: npmCommand not pinned by hash: .github/workflows/create_release_branch.yml:69","Warn: npmCommand not pinned by hash: .github/workflows/issue_wrong_template.yml:20","Warn: npmCommand not pinned by hash: .github/workflows/popular.yml:21","Warn: npmCommand not pinned by hash: .github/workflows/pull_request_stats.yml:187","Warn: npmCommand not pinned by hash: .github/workflows/rspack-update-tests-manifest.yml:52","Warn: npmCommand not pinned by hash: .github/workflows/rspack-update-tests-manifest.yml:115","Warn: npmCommand not pinned by hash: .github/workflows/sync_backport_canary_release.yml:82","Warn: npmCommand not pinned by hash: .github/workflows/test_e2e_deploy_release.yml:83","Warn: npmCommand not pinned by hash: .github/workflows/test_e2e_project_reset_cron.yml:40","Warn: npmCommand not pinned by hash: .github/workflows/test_examples.yml:50","Warn: npmCommand not pinned by hash: .github/workflows/trigger_release.yml:110","Warn: npmCommand not pinned by hash: .github/workflows/turbopack-benchmark.yml:60","Warn: npmCommand not pinned by hash: .github/workflows/turbopack-benchmark.yml:102","Warn: npmCommand not pinned by hash: .github/workflows/turbopack-update-tests-manifest.yml:52","Warn: npmCommand not pinned by hash: .github/workflows/turbopack-update-tests-manifest.yml:111","Warn: npmCommand not pinned by hash: .github/workflows/update_fonts_data.yml:51","Warn: npmCommand not pinned by hash: .github/workflows/update_react.yml:64","Warn: npmCommand not pinned by hash: .github/workflows/upload-tests-manifest.yml:35","Info: 136 out of 136 GitHub-owned GitHubAction dependencies pinned","Info:  24 out of  25 third-party GitHubAction dependencies pinned","Info:   2 out of  38 containerImage dependencies pinned","Info:   0 out of   6 downloadThenRun dependencies pinned","Info:   9 out of  39 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 28 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast"}}]}