nordisk/ci-status

runs/scorecard-gunnar/20261029T1732Z-d419ac64/summary.md

OpenSSF Scorecard v5.6.0, local mode, on `gunnar` at `d419ac64`: **5.2 / 10** (the aggregate of the checks local mode runs).

| check | score | reason |
|---|---|---|
| Binary-Artifacts | 10 / 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |
| Dependency-Update-Tool | 0 / 10 | no update tool detected |
| Fuzzing | 0 / 10 | project is not fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | 0 / 10 | dependency not pinned by hash detected -- score normalized to 0 |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |
| Vulnerabilities | 0 / 10 | 40 existing vulnerabilities detected |

Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.