OpenSSF Scorecard & repo health

Frammenti di codice

curl "https://api.oanor.com/depsdev-api/v1/project" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/depsdev-api/v1/project", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/depsdev-api/v1/project");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/depsdev-api/v1/project",
    headers={"x-oanor-key": "oanor_test_..."}
)

Risposta di esempio

Una risposta reale di questo endpoint, acquisita dall'ultimo health check.

{
    "data": {
        "project": {
            "id": "github.com/expressjs/express",
            "forks": 23442,
            "stars": 69057,
            "license": "MIT",
            "homepage": "https://expressjs.com",
            "scorecard": {
                "date": "2026-05-18T00:00:00Z",
                "repo": "github.com/expressjs/express",
                "score": 8.5,
                "checks": [
                    {
                        "name": "Maintained",
                        "score": 10,
                        "reason": "18 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10"
                    },
                    {
                        "name": "Dangerous-Workflow",
                        "score": 10,
                        "reason": "no dangerous workflow patterns detected"
                    },
                    {
                        "name": "Packaging",
                        "score": -1,
                        "reason": "packaging workflow not detected"
                    },
                    {
                        "name": "Code-Review",
                        "score": 10,
                        "reason": "all changesets reviewed"
                    },
                    {
                        "name": "Binary-Artifacts",
                        "score": 10,
                        "reason": "no binaries found in the repo"
                    },
                    {
                        "name": "Token-Permissions",
                        "score": 10,
                        "reason": "GitHub workflow tokens follow principle of least privilege"
                    },
                    {
                        "name": "Pinned-Dependencies",
                        "score": 6,
                        "reason": "dependency not pinned by hash detected -- score normalized to 6"
                    },
                    {
                        "name": "CII-Best-Practices",
                        "score": 0,
                        "reason": "no effort to earn an OpenSSF best practices badge detected"
                    },
                    {
                        "name": "License",
                        "score": 10,
                        "reason": "license file detected"
                    },
                    {
                        "name": "Fuzzing",
                        "score": 0,
                        "reason": "project is not fuzzed"
                    },
                    {
                        "name": "Security-Policy",
                        "score": 10,
                        "reason": "security policy file detected"
                    },
                    {
                        "name": "Branch-Protection",
                        "score": -1,
                        "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https
…