Öffentliches RegisterMittel
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.14.0 · 2026-07-31 23:09 UTC
jedisct1 / rust-jwt-simple
A secure, standard-conformant, easy to use JWT implementation for Rust.
jedisct1/rust-jwt-simple erreicht einen Gesundheitsindex von 60 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Vitality (77/100) ab, am schwächsten bei AI Readiness (35/100). Zuletzt vor 1 Tag aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
60
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
60
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
Frank DenisPersönliches Konto
4.316 Follower518 öffentliche Reposseit Sept. 2009
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Paket-Ökosysteme
| Registry | Paket | Version | Downloads / Monat | Versionen | Zuletzt veröffentlicht | Tags |
|---|---|---|---|---|---|---|
| crates.io | jwt-simple | 0.13.0 | 267.853 | 71 | vor 1 Tag | jsonauthenticationjwtjwstokenswasmapi-bindingsweb-programmingcryptography |
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
77
Wie die Bewertung erfolgt
| 36/36 | Push-Aktualität — letzter Push vor 1 Tagen |
| 9.7/36 | Commit-Rhythmus — 14/52 Wochen mit Commits |
| 16.6/18 | Commit-Volumen — 69 Commits im letzten Jahr |
| 10/10 | OpenSSF Scorecard: Maintained — 27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
Verwendete Eingangsdaten
| commits_last_year | 69 |
| human_commit_share | 1 |
| days_since_last_push | 1 |
| active_weeks_last_year | 14 |
Release-Disziplin
84Gut
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 10 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 1 Tagen |
| 12.6/27 | Release-Rhythmus — ein Release etwa alle 203,1 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — keine Daten |
Verwendete Eingangsdaten
| releases_count | 10 |
| latest_release_tag | 0.13.0 |
| releases_from_tags | nein |
| days_since_latest_release | 1 |
| mean_days_between_releases | 203,1 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
60
Popularität & Verbreitung
55Mittel
Wie die Bewertung erfolgt
| 39.6/60 | Stars — 278 Stars |
| 15/25 | Forks — 64 Forks |
| 0/15 | Watcher — 2 Watcher |
Verwendete Eingangsdaten
| forks | 64 |
| stars | 278 |
| watchers | 2 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
44Gefährdet
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 16.9/22.5 | Lizenz — Lizenzdatei vorhanden, keine anerkannte Lizenz |
| 0/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | nein |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Ökosystem-Verbreitung (Downloads)
91Exzellent
Wie die Bewertung erfolgt
| 72.4/80 | Downloads pro Monat — 267.853 Downloads/Monat über crates |
| 0/20 | Abhängige in der Registry — von diesem Ökosystem nicht ausgewiesen |
Verwendete Eingangsdaten
| packages | jwt-simple |
| dependents | — |
| ecosystems | crates |
| total_downloads | 5.602.868 |
| monthly_downloads | 267.853 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Abhängige in der Registry. Die verbleibenden Gewichte wurden renormalisiert.
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
63
Maintainer-Resilienz (Bus-Faktor)
33Gefährdet
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0.7/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 97 % der Commits |
| 13.5/13.5 | Breite der Beitragenden — 12 Beitragende |
| 10/10 | OpenSSF Scorecard: Contributors — project has 3 contributing companies or organizations -- score normalized to 10 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 12 |
| top_contributor_share | 0,968 |
Wie die Bewertung erfolgt
| 46.8/46.8 | Issue-Lösungsquote — 100 % der Issues geschlossen |
| 8.8/38.3 | PR-Annahme — 15/65 entschiedene PRs gemergt |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 15 |
| open_issues | 0 |
| closed_issues | 64 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 50 |
Wie die Bewertung erfolgt
| 10/30 | Organisatorische Trägerschaft — persönliches (Nutzer-)Konto |
| 0/20 | Verifizierte Domain — für Nutzerkonten nicht anwendbar |
| 25/25 | Reichweite des Inhabers — 4.316 Follower von jedisct1 |
| 25/25 | Kontohistorie — 518 öffentliche Repos, Kontoalter ca. 16 Jahre |
Verwendete Eingangsdaten
| followers | 4.316 |
| owner_type | User |
| is_verified | — |
| owner_login | jedisct1 |
| public_repos | 518 |
| account_age_days | 6.169 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Verifizierte Domain. Die verbleibenden Gewichte wurden renormalisiert.
Paketpflege
100Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 1 Paket(e) auf crates |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 1 Tagen |
| 20/20 | Versionshistorie — 71 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | jwt-simple |
| ecosystems | crates |
| any_deprecated | nein |
| min_days_since_publish | 1 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
44
Engineering-Praktiken
30Gefährdet
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 2 Workflow(s) |
| 0/24 | Tests vorhanden |
| 0/16 | Linter-Konfiguration |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — keine Daten |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | nein |
| has_editorconfig | nein |
| has_linter_config | nein |
| has_precommit_config | nein |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: CI-Tests. Die verbleibenden Gewichte wurden renormalisiert.
Dokumentation
65Mittel
Wie die Bewertung erfolgt
| 30/30 | README |
| 0/25 | Dokumentationsverzeichnis |
| 15/15 | Dokumentations-/Homepage-Site — https://crates.io/crates/jwt-simple |
| 10/10 | Repository-Beschreibung |
| 10/10 | Topics — 13 Topics |
| 0/10 | Wiki |
Verwendete Eingangsdaten
| topics | jwt, rust, tokens, authentication, web, json, jsonwebtokens, simple, crypto, okta, auth0, api, jws |
| has_wiki | nein |
| homepage | https://crates.io/crates/jwt-simple |
| has_readme | ja |
| has_docs_dir | nein |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
50
Sicherheitslage
50Mittel
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — keine Daten |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 2.5/2.5 | Contributors — project has 3 contributing companies or organizations -- score normalized to 10 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.2/2.5 | Lizenz — license file detected |
| 7.5/7.5 | Maintained — 27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — keine Daten |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — keine Daten |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 5 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): ci_tests, packaging, signed_releases. Die verbleibenden Gewichte wurden renormalisiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
35
AI-Agentenkontext & Leitlinien
11Kritisch
Wie die Bewertung erfolgt
| 0/45 | Agentenanweisungen — keine CLAUDE.md / AGENTS.md / Editor-Regeln |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 10.7/40 | Lesbare Commit-Historie — 20 von 100 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 0,2 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Wie die Bewertung erfolgt
| 12.6/18 | Bootstrap mit einem Befehl — Cargo.toml (Toolchain-Konvention, kein Task-Runner) |
| 0/22 | Automatisierte Tests |
| 0/11 | Lint-/Format-Konfiguration |
| 11/11 | Statische Typprüfung — Rust (statisch typisiert) |
| 0/10 | Reproduzierbare Umgebung |
| 0/10 | Belegte Agentenpraxis — keine von Agenten verfassten Commits unter den letzten 100 |
| 5/8 | Automatisierte Wartung — Abhängigkeits-Automatisierung konfiguriert, in den erfassten Commits nicht beobachtet |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | nein |
| lockfiles | — |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | — |
| has_devcontainer | nein |
| has_linter_config | nein |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | Cargo.toml |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
100Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — Rust (statisch typisiert) |
| 55/55 | Handhabbare Dateigrößen — 0/24 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | Rust |
| largest_source_bytes | 57.016 |
| source_files_sampled | 24 |
| oversized_source_files | 0 |
Eckdaten
278GitHub-Sterne
12Mitwirkende
69Commits, letzte 12 Monate
1Tage seit letztem Push
10Releases
1Bus-Faktor
0offene Issues
crates.ioPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 64 ⇿
0Sterne
64Forks
8Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 1Patch 7
Jeder Punkt umfasst 6 Tage.
OpenSSF Scorecard 5.0 / 10
5.0Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| k. A. | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 10 | Contributors | project has 3 contributing companies or organizations -- score normalized to 10 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 9 | License | license file detected |
| 10 | Maintained | 27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| k. A. | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| k. A. | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
Direkte Abhängigkeiten 18
| Registry | Paket | Versionsvorgabe | Manifest |
|---|---|---|---|
| crates.io | anyhow | 1.0.104 | Cargo.toml |
| crates.io | blake2b_simd | 1.0.4 | Cargo.toml |
| crates.io | binstring | 0.1.7 | Cargo.toml |
| crates.io | ciborium | 0.2.2 | Cargo.toml |
| crates.io | coarsetime | 0.1.37 | Cargo.toml |
| crates.io | ct-codecs | 1.1.7 | Cargo.toml |
| crates.io | ed25519-compact | 2.3.1 | Cargo.toml |
| crates.io | hmac-sha1-compact | 1.1.7 | Cargo.toml |
| crates.io | hmac-sha256 | 1.1.14 | Cargo.toml |
| crates.io | hmac-sha512 | 1.1.12 | Cargo.toml |
| crates.io | k256 | 0.14.0 | Cargo.toml |
| crates.io | p256 | 0.14.0 | Cargo.toml |
| crates.io | p384 | 0.14.0 | Cargo.toml |
| crates.io | rand | 0.10.2 | Cargo.toml |
| crates.io | serde | 1.0.229 | Cargo.toml |
| crates.io | serde_json | 1.0.151 | Cargo.toml |
| crates.io | thiserror | 2.0.19 | Cargo.toml |
| crates.io | zeroize | 1.9.0 | Cargo.toml |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"jwt",
"rust",
"tokens",
"authentication",
"web",
"json",
"jsonwebtokens",
"simple",
"crypto",
"okta",
"auth0",
"api",
"jws"
],
"is_fork": false,
"size_kb": 478,
"has_wiki": false,
"homepage": "https://crates.io/crates/jwt-simple",
"languages": {
"Rust": 317945
},
"pushed_at": "2026-07-30T20:13:20Z",
"created_at": "2020-08-28T19:34:24Z",
"owner_type": "User",
"updated_at": "2026-07-30T20:14:01Z",
"description": "A secure, standard-conformant, easy to use JWT implementation for Rust.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "master",
"license_spdx_raw": "NOASSERTION",
"primary_language": "Rust",
"significant_languages": [
"Rust"
]
},
"owner": {
"blog": "https://primulinus.com",
"name": "Frank Denis",
"type": "User",
"login": "jedisct1",
"company": null,
"location": "Antibes, France",
"followers": 4316,
"avatar_url": "https://avatars.githubusercontent.com/u/124872?v=4",
"created_at": "2009-09-09T10:20:57Z",
"is_verified": null,
"public_repos": 518,
"account_age_days": 6169
},
"license": {
"state": "custom",
"spdx_id": null,
"raw_spdx": "NOASSERTION",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "0.13.0",
"kind": "minor",
"published_at": "2026-07-30T15:59:11Z"
},
{
"tag": "0.12.17",
"kind": "patch",
"published_at": "2026-07-01T12:13:46Z"
},
{
"tag": "0.12.14",
"kind": "patch",
"published_at": "2026-01-20T17:23:41Z"
},
{
"tag": "0.12.13",
"kind": "patch",
"published_at": "2025-10-30T21:27:29Z"
},
{
"tag": "0.12.12",
"kind": "patch",
"published_at": "2025-03-03T22:23:58Z"
},
{
"tag": "0.12.6",
"kind": "patch",
"published_at": "2023-12-17T17:55:35Z"
},
{
"tag": "0.12.0",
"kind": "minor",
"published_at": "2023-11-30T13:16:35Z"
},
{
"tag": "0.11.6",
"kind": "patch",
"published_at": "2023-07-28T03:44:19Z"
},
{
"tag": "0.11.1",
"kind": "patch",
"published_at": "2022-10-03T23:44:52Z"
},
{
"tag": "0.10.3",
"kind": "patch",
"published_at": "2021-07-28T11:44:09Z"
}
],
"recent_commits": [
{
"oid": "1887cdf9d22e6ee6fa2332e158331387043779a9",
"body": null,
"is_bot": false,
"headline": "Add some documentation about RSA-OAEP and ECDH-ES caveats",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T20:13:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ba8159d1f2f7e9e153c80d3e21190bdf7aff38a",
"body": null,
"is_bot": false,
"headline": "Bump version to 0.13.0",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T15:55:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "55f50ee966e257b95ec52a19bf002f2f52e637dc",
"body": null,
"is_bot": false,
"headline": "Shorten",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T15:11:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aac4fa2633e3f9b6631a7fb7ea0cefc931e67486",
"body": null,
"is_bot": false,
"headline": "Add support for ML-DSA signatures",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T15:09:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38aefc660e8ef11ee1ee092be35255fa115fb866",
"body": null,
"is_bot": false,
"headline": "Superboring is not optional any more",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T15:03:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48be518f142e42de4b1ad05c8adba71b71785b58",
"body": null,
"is_bot": false,
"headline": "Update superboring",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T14:37:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ad679a1f68c1aaab6c979bbafcdd1af9065b5a45",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T13:24:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2dc7c419e03dc21c1a9b649ee88ccc06863c83a0",
"body": "** Classification\n\n- **Type:** Authorization bypass\n- **Severity:** High\n- **Confidence:** Certain\n\n** Affected Locations\n\n- `src/cwt_token.rs:503-545` (`deserialize_custom_claims`)\n- `src/cwt_token.rs:694` (`JWTClaims::mix_cwt`, the only caller)\n\n** Summary\n\nCWT verification replaced custom claims \n[…]\ndecision, left out of this patch.\n\nThe public custom-claim APIs retain their `Default` bound for compatibility with existing type signatures. Removing that unnecessary bound is a separate API cleanup.",
"is_bot": false,
"headline": "* CWT Custom-Claim Deserialization Fails Open",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T12:37:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "60b9ea8fe74ca1c43b830ba9f0fe7237796a9e3b",
"body": "** Classification\n\n- **Type:** Denial of service\n- **Severity:** Medium\n- **Confidence:** Certain\n- **Weakness:** Uncontrolled resource consumption\n\n** Affected Locations\n\n- `src/jwe_token.rs:26` (`*[derive(..., Default)]` on `DecryptionOptions`)\n- `src/jwe_token.rs:166` (conditional total-length ch\n[…]\nhe untrusted-JSON argument that motivates the JWS limit carries over unchanged.\nUnder the symmetric key-wrap modes it does not: there, a token that unwraps came from someone holding the shared secret.",
"is_bot": false,
"headline": "* JWE Decryption Has No Default Token Size Limit",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T12:15:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "06d9679d3baf8b32289ca2c1b2853e81364e2dff",
"body": "** Classification\n\n- **Type:** Denial of service\n- **Severity:** Medium\n- **Confidence:** Certain\n- **Weakness:** Uncontrolled resource consumption\n\n** Affected Locations\n\n- `src/cwt_token.rs:68`\n- `CWTToken::decode_metadata`\n- `CWTToken::verify`\n\n** Summary\n\nBoth CWT entry points deserialize the co\n[…]\ne one implementation. It is already compiled as a transitive dependency but is not re-exported by `ciborium`, so using it means naming it in `Cargo.toml`. That is a dependency decision, not a cleanup.",
"is_bot": false,
"headline": "* Unbounded CBOR Materialization in CWT Metadata Decoding",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T11:34:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "acdfbcfe5211067e364fc579a84bbe94a7cbd8f2",
"body": "** Classification\n\n- **Type:** Security control bypass\n- **Severity:** Medium\n- **Confidence:** Certain\n\n** Affected Locations\n\n- `src/cwt_token.rs:113-122`\n- `src/cwt_token.rs:193-200`\n- `src/cwt_token.rs:516-593`\n- `CWTToken::verify`\n- `CWTToken::decode_metadata`\n\n** Summary\n\nCWT verification merg\n[…]\nnce behavior RFC 9052 describes, so it is not a spec violation, but it means those two options are checked against unauthenticated data whenever the signer left the corresponding protected header out.",
"is_bot": false,
"headline": "* CWT Unprotected Headers Overwrite Protected Critical Parameters",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T09:21:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dec6261ba4c901be9e0de6be32a6b09257826e41",
"body": "** Classification\n\n- **Type:** Authorization bypass\n- **Severity:** Medium\n- **Confidence:** Certain\n\n** Affected Locations\n\n- `src/claims.rs:604-614`\n- `JWTClaims::validate`\n\n** Summary\n\nConfiguring `VerificationOptions::max_validity` did not require an `iat` claim. The maximum-age check ran only w\n[…]\n Residual Risk\n\nToken issuers should populate `iat` consistently. Applications requiring replay resistance should also configure `reject_before` or maintain a token identifier denylist as appropriate.",
"is_bot": false,
"headline": "* Max-Validity Policy Allows Tokens Without Issued-At",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T08:22:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d4e6b8618cde50c68cf01cf4f4795580d91caf41",
"body": "** Classification\n\n- **Type:** Authorization bypass\n- **Severity:** High\n- **Confidence:** Certain\n\n** Affected Locations\n\n- `src/jwe_token.rs:231-236`\n- `DecryptionOptions::claim_options`\n- `JWEToken::decrypt`\n\n** Summary\n\nDefault JWE decryption returned authenticated plaintext claims without valid\n[…]\ne, .. })` or otherwise relax the options it supplies.\n\n** Residual Risk\n\nApplications that need issuer, audience, subject, or nonce checks must still configure those application-specific requirements.",
"is_bot": false,
"headline": "* JWE Decryption Skips Claim Validation by Default",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T08:15:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "34d7db1bbdaf7ed776ca6fde16f27d3ee5a5431d",
"body": "** Classification\n\n- **Type:** Authorization bypass\n- **Severity:** Medium\n- **Confidence:** Certain\n\n** Affected Locations\n\n- `src/serde_additions.rs:15-20`\n- `unix_timestamp::TimestampVisitor::visit_i64`\n\n** Summary\n\nJWT NumericDate values encoded as negative JSON integers were cast directly from \n[…]\nhe floating-point visitor should also reject non-finite, negative, and out-of-range input for consistent NumericDate handling. That hardening is separate from the signed-integer wraparound fixed here.",
"is_bot": false,
"headline": "* Negative JWT Timestamps Wrap to Far-Future Values",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T08:13:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c97e9657e1fc9804888961a8c5fcb304ac70ad0c",
"body": "** Classification\n\n- **Type:** Denial of service\n- **Severity:** Medium\n- **Confidence:** Certain\n- **Weakness:** Uncontrolled resource consumption\n\n** Affected Locations\n\n- `src/jwe_token.rs:171`\n- `JWEToken::decrypt`\n\n** Summary\n\n`JWEToken::decrypt` collected every dot-separated segment of an atta\n[…]\ning. [Finding 004](004-jwe-decryption-has-no-default-token-size-limit.md) closes that gap by giving JWE decryption the same finite default token-length limit that JWS and CWT verification already use.",
"is_bot": false,
"headline": "* Unbounded JWE Segment Collection Before Format Validation",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T08:11:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa87197f0aa1d3db2390e4e4f38a9fd8c378443c",
"body": "** Classification\n\n- **Type:** Security control failure\n- **Severity:** Low\n- **Confidence:** Certain\n\n** Affected Locations\n\n- `src/algorithms/jwe/rsa_oaep.rs:69`, public-key validation\n- `src/algorithms/jwe/rsa_oaep.rs:202`, private-key validation\n- `src/algorithms/jwe/rsa_oaep.rs:130`, `Debug` ou\n[…]\ndual Risk\n\nNone for RSA-OAEP.\nSeparately, the JWS RSA key types accept any modulus size that the backend can parse; adding a floor there is a distinct hardening change and is not part of this finding.",
"is_bot": false,
"headline": "* RSA Modulus Validation Rounds Bit Length Up",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T08:10:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "207d9f4c6e55504bb1d8466d4fb5c78c0ef3d846",
"body": null,
"is_bot": false,
"headline": "Emphasis that this is temporary until we ship wasm boringssl",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-30T06:37:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3da7ffb1bd84f675b2c957d260f39f86731d368f",
"body": null,
"is_bot": false,
"headline": "Update benchmarks",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:47:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e1cc6ff88cd35ac1925ef750e6db0cd9be6c7eaf",
"body": "* 'master' of github.com:jedisct1/rust-jwt-simple:\n Add wasi-crypto feature",
"is_bot": false,
"headline": "Merge branch 'master' of github.com:jedisct1/rust-jwt-simple",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:10:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "edf0015a5fe46f70c1d2f62d6664e9b2173b6384",
"body": null,
"is_bot": false,
"headline": "Cleanup Cargo package",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:10:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32dc1f64cff09044449a7c6621309a1df66a6706",
"body": "* 'master' of github.com:jedisct1/rust-jwt-simple:\n Update .gitignore\n Use a longer key for the CWT test",
"is_bot": false,
"headline": "Merge branch 'master' of github.com:jedisct1/rust-jwt-simple",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:08:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "210d36eced1cc8d2036f3cf2acc64b17e282a9dd",
"body": null,
"is_bot": false,
"headline": "Bump",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:08:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76e8bc3781d119b6c61c92c5d85768b96583f960",
"body": null,
"is_bot": false,
"headline": "Add wasi-crypto feature",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:06:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4660aeb2cdfb6ccd04971bb07a2cb0475d8a38c2",
"body": null,
"is_bot": false,
"headline": "Update .gitignore",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:04:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d8aa84aa37d9c302bd157dde5ee56d26e8c568d",
"body": null,
"is_bot": false,
"headline": "Use a longer key for the CWT test",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-07-01T12:03:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a3a19b08e63f2c2ddfd98cd23d8125834c68af",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-06-30T21:32:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e1b7827dae9d1acaf37c78ad785038ba1b2000c",
"body": null,
"is_bot": false,
"headline": "superboring update for WebAssembly",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-05-11T14:17:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b38b1098d9116c34d98c18c4ece719794327be19",
"body": null,
"is_bot": false,
"headline": "Update superboring",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-23T14:19:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44f5e5b2705d2476313d0ca64f2df95da48c0301",
"body": null,
"is_bot": false,
"headline": "Bump",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-23T07:22:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2794afcd0d4abdb51ad768ea5bc91234f20f3d45",
"body": null,
"is_bot": false,
"headline": "Bump",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-23T07:22:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb09ebad7232c2bfd5a39ec847c46b30c4ad0a8b",
"body": null,
"is_bot": false,
"headline": "Update the rand and boring crates",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-23T06:56:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "69e0765e0775c6fe87622b81b7f68ed846857cbc",
"body": "Automatically found and fixed by Swival Security Scanner https://swival.dev",
"is_bot": false,
"headline": "Reject unsupported JWT/CWT critical headers",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-12T11:33:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "60fc1c73f1fb0cf360799bd4727a6d2d1e387835",
"body": null,
"is_bot": false,
"headline": "Match Debug traits of keys with what the \"boring\" crate returns",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-10T16:33:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ee21a03565fada41906242561e09bd8c454edd76",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-04-10T16:25:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "66a39a2d83f7e0105f5e2ba37dd0d0625a759e46",
"body": null,
"is_bot": false,
"headline": "swival /simplify",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-03-29T18:36:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58328e26aa78cb674fef39c16831b38b78009877",
"body": null,
"is_bot": false,
"headline": "Update .gitignore",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-03-29T18:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d08fca89b3e132ae8543c021cf61a3c571cff14",
"body": null,
"is_bot": false,
"headline": "Upgrade to boring v5",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-02-11T10:44:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4581e4b7de7f0efe97e07b3ae75ebd48916c6966",
"body": null,
"is_bot": false,
"headline": "Ignore single-line doc examples",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T17:09:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9d6dcf1a95d75fa9c2775b72986489ebe00319e",
"body": null,
"is_bot": false,
"headline": "Sync std/lib.rs doc",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T17:05:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52390ec8f2ced17e72cf1a14e3aa27ffcb8b5b56",
"body": null,
"is_bot": false,
"headline": "Format",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T17:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91b332b4b7a5ed1f9a14ae9c7647d9df3f88f209",
"body": null,
"is_bot": false,
"headline": "Nits",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T17:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a2ef17bd86a6e95ac5b1c41387bc6cd15f979bd9",
"body": null,
"is_bot": false,
"headline": "RSA-OAEP-256 -> RSA-OAEP",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T17:02:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e31d0a0e3d78f72c68a61f82c188198ac7f5aae0",
"body": null,
"is_bot": false,
"headline": "Documentation fixes",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T16:45:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "642e87888d54006a9ec6946a47011d30d6bcfc15",
"body": "And add a test for that",
"is_bot": false,
"headline": "Bypass the issued_at check if accept_future is set",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T16:45:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3798267251e90c739a361c4db6cf88690025a272",
"body": null,
"is_bot": false,
"headline": "Nits",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T16:44:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "546acedacb4134578c19d0eec2741e1dbea2bda8",
"body": null,
"is_bot": false,
"headline": "CWT RSA verification now applies the configured padding scheme",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T16:44:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dfd4e525c1926e1a824c6389489f3cdc7cbe9698",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-20T15:43:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f3f33c915de59cf89419a537770e4a5675bd729",
"body": null,
"is_bot": false,
"headline": "anyhow is enough",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-06T19:37:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94a59478a75c5ed0fd5441961528e394324cddf0",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-06T19:27:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "baeaf9dba01e850b2dddc1cf6bac1188f0164e19",
"body": null,
"is_bot": false,
"headline": "2026",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2026-01-06T19:27:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73e4e9841007abc732e1217098ca596c48107b6c",
"body": null,
"is_bot": false,
"headline": "Format",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-25T13:59:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e9a843116500a719a6b31154310a2f77645abc8",
"body": null,
"is_bot": false,
"headline": "Remove timingsafe_eq, just use ct-codec's verify function",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-18T12:40:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34ad8c62ec0d0450a5125e996fd96f95bb3e24fd",
"body": null,
"is_bot": false,
"headline": "Make jwe a cargo feature for now",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-17T22:59:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57fc5ca3cf7feebf7b0cbfb0a42f24aede063415",
"body": null,
"is_bot": false,
"headline": "Do not recommend RSA-OAEP",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-17T21:34:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4210cfa9810bf3d051ab89222a4959fad8583b54",
"body": null,
"is_bot": false,
"headline": "Add support for jwe",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-17T21:05:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "00f67ab4385645a34554457af916f2ba1a410f95",
"body": null,
"is_bot": false,
"headline": "Update superboring",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-17T19:15:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10917ade7770572e018fb2e47384e27352f11d71",
"body": null,
"is_bot": false,
"headline": "Require HMAC keys to be at least 96 bits long",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-17T18:48:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32da34caf1a3894e9eeb7c256daaeec2326fc18c",
"body": null,
"is_bot": false,
"headline": "Remove 'static requirement",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T20:51:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67a34fbeb6e82498038472642a78dfe15cca9729",
"body": null,
"is_bot": false,
"headline": "Update doc",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T17:49:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2474cf0e3179686c4068daff10b8fa3660196227",
"body": null,
"is_bot": false,
"headline": "Salt: don't panic if decode_to_vec() fails",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T17:45:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d602836d99f8a11aef59285432797e9d8b7ea5d5",
"body": null,
"is_bot": false,
"headline": "The reject_before verif option should be checked against issued_at",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T17:44:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7f71df629836ac2012a91cb3e316ef2a3b1067c",
"body": "Some functions only need the \"Serialize\" trait, while other functions\nonly need the \"DeserializeOwner\" trait.\n\nFixes #119",
"is_bot": false,
"headline": "Define CustomClaims differently depending on the function",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T17:19:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "198d6f084b930c11488426319be6e138b8b48182",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T17:08:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d6fffcce19107b83878a54bc998b11a66c50304",
"body": null,
"is_bot": false,
"headline": "Add a tolerance for the cwt tests",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-12-09T17:06:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1487c870cbae28c6d91d88e68ca8e6a02d6ae0db",
"body": null,
"is_bot": false,
"headline": "Bump",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-10-30T21:26:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f1b47d30492011f3d4e96adc4235fa99941fa11",
"body": null,
"is_bot": false,
"headline": "Typo",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-10-30T21:26:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a2bf7b29165db3fff586e655a65684c1bdc552e2",
"body": null,
"is_bot": false,
"headline": "Non need to unwrap() if we can return an error",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-10-30T21:26:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24e16fa71df5ec179c998fd937534cdc2251950d",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-10-30T21:22:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fb2bd914ef31f5f3215849fe0d29a81109e4cb2",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-09-03T09:38:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e2a53e1f0b3850bca318480652bc33d0e18033e",
"body": null,
"is_bot": false,
"headline": "Document how to use enums in serialized data in Rust",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-13T22:34:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c18ce4e84700293769133302f37dc6d055b9e389",
"body": null,
"is_bot": false,
"headline": "Convert CWT keys to strings because serde only supports that",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-13T21:47:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "682d898978840ba777e3395943c6b874c8dd8345",
"body": null,
"is_bot": false,
"headline": "Remove confusing test",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-13T20:26:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "411945857165c22e537865c0f2b6b034e634a101",
"body": null,
"is_bot": false,
"headline": "Nits",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-13T20:21:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b975764f678f4dec48f8f19b80b7baa0287f0d1",
"body": null,
"is_bot": false,
"headline": "Another test with custom CWT claims",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-13T20:11:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d162232f8b9d63502017ad1c2d5e8c5c920ffd83",
"body": null,
"is_bot": false,
"headline": "Doc",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-11T21:13:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5706578e397f416805c3e29d28889d4930c7be49",
"body": null,
"is_bot": false,
"headline": "Support custom CWT claims",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-11T21:09:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba3ae0279da3abebf545a12fab299294e15f1876",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T21:50:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ddf5330904b27fb50f73af3647df1c9fa7e1433",
"body": "Fixes compilation error when using the cwt feature by adding a Default\nimplementation for JWTClaims<NoCustomClaims>, which is required in cwt_token.rs.",
"is_bot": false,
"headline": "Add Default implementation for JWTClaims<NoCustomClaims>",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T21:47:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8383efdb72f7b6f2911a44656ceb26b63b6b413a",
"body": null,
"is_bot": false,
"headline": "Remove key_id from the claims",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T21:28:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c091eb34e4ff4f6688730b22d4ff65b3d7a37cda",
"body": "- Remove unnecessary unwrap() on Some values in JWTClaims constructor methods\n- Add is_empty() method to Salt enum to satisfy clippy::len_without_is_empty",
"is_bot": false,
"headline": "Fix Clippy warnings",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T21:09:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f0bef3454d694133c2ba08425d5fee603b74ea7",
"body": "…rectly\n\n- Replace incorrect UTF-8 validation with std::str::from_utf8 for proper checking\n- Use String::from_utf8_lossy for safe display of valid UTF-8 content\n- Update test case to avoid using unsafe code while still testing the functionality",
"is_bot": false,
"headline": "Fix Debug implementation for JWTClaims to handle UTF-8 validation cor…",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T21:06:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77411137751054551e2324b1c336ebfb2cc8c1df",
"body": null,
"is_bot": false,
"headline": "Better documemtation for the public API",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T20:52:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "103a0fee33f1ce538faedade05ea59e5751dc751",
"body": null,
"is_bot": false,
"headline": "Nits",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T20:40:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7634af83df73c00c51404bda4453e77632a0dc4c",
"body": null,
"is_bot": false,
"headline": "Improve comment",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T20:37:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb4dd49886fa2d87ea1629f5b0d0ff43c669b06a",
"body": "Implement a custom Debug trait for JWTClaims that properly handles binary data\nin the jwt_id and nonce fields. When these fields contain valid UTF-8, they're\ndisplayed normally as strings. For binary data containing invalid UTF-8, the\nvalues are hex-encoded for better readability.\n\n- Removed automatic Debug trait derivation for JWTClaims\n- Added custom Debug implementation that checks UTF-8 validity\n- Added test case to verify correct display behavior",
"is_bot": false,
"headline": "Improve Debug formatting for JWTClaims with non-UTF8 data",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T20:35:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "382084dd75d20202b119f92d1b2949bdbdbdfc52",
"body": null,
"is_bot": false,
"headline": "Fix sign_with_options. AI agents > humans",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T14:34:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "55b5846078a7c415ab4e80dffce7be896b0a6a71",
"body": "…a regression\"\n\nThis reverts commit 9fcfae7ef560ea624035162e4984802ce3328887.",
"is_bot": false,
"headline": "Revert \"Trying to address user request #113 seems to have introduced …",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T14:17:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b59a7be40cc7aa76a0bd6a7dd1be9733cf3a9add",
"body": "This commit adds the ability to peek at CWT token metadata without\nverifying the signature, similar to how Token::decode_metadata works\nfor JWT tokens.\n\n- Implement CWTToken::decode_metadata method that extracts header\n information from CWT tokens\n- Add decode_cwt_metadata method to all algorithm-s\n[…]\ncation failure\n\nThis change allows applications to extract information like key_id\nfrom CWT tokens before verification, making it easier to select the\nappropriate key when multiple keys are available.",
"is_bot": false,
"headline": "Add support for peeking at CWT token metadata",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T14:13:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c049eb754edab75c2b2f064690b430d5087e469a",
"body": null,
"is_bot": false,
"headline": "Update .gitignore",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T14:13:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fcfae7ef560ea624035162e4984802ce3328887",
"body": "…sion",
"is_bot": false,
"headline": "Trying to address user request #113 seems to have introduced a regres…",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T14:09:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "931df88b5eda7ed1f53a3d2c26d16a2c96eb513e",
"body": "Per the CWT specification (RFC 8392), CWT tokens can optionally be wrapped\nwith a tag of type 61 to indicate that the following structure is a CBOR Web\nToken. This change enables verification of such wrapped tokens while\nmaintaining backward compatibility with unwrapped tokens.\n\nThe implementation now handles three cases:\n1. Direct COSE_Mac0 (tag 17)\n2. Direct COSE_Sign1 (tag 18)\n3. CWT tag (61) wrapping either COSE_Mac0 or COSE_Sign1\n\nA test case has been added to verify this functionality.",
"is_bot": false,
"headline": "Add support for CWT tokens wrapped in tag 61",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-05-07T12:30:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4906089777e7f11e31b52e35920530e136ab608c",
"body": null,
"is_bot": false,
"headline": "Nits",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-04-29T23:30:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ea0ef8f70b4d2848af2e441919e6a0e6705a1bd",
"body": null,
"is_bot": false,
"headline": "Update deps",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-04-19T09:05:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "00cae63bd75ce39342994d75b41f6347423e79f9",
"body": null,
"is_bot": false,
"headline": "!is_none -> is_some",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-04-19T09:04:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bf11f243a4d29277229861255a128600e8b7ec5",
"body": "* Added support for custom content_type and signature_type (#111)\n\n* Replaced the `for_content/signature_type` with `HeaderOptions`\n\n* *with_header_options has become *with_options\n\n---------\n\nCo-authored-by: Frank Denis <124872+jedisct1@users.noreply.github.com>",
"is_bot": false,
"headline": "Added support for custom content_type and signature_type (#111) (#112)",
"author_name": "Joshua Barrett",
"author_login": "jjbarr",
"committed_at": "2025-04-19T09:01:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4369243d15517cff53390c65f341d0352042afcc",
"body": "Fixes #113",
"is_bot": false,
"headline": "replace required_public_key with required_key_id",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-04-12T06:42:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb1b29917679cf729c825dd82d8857f7a98c319f",
"body": null,
"is_bot": false,
"headline": "Update .gitignore",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-03-03T22:21:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "db4da1f3e2e74be3ea2240ae4a28b454fdd14587",
"body": null,
"is_bot": false,
"headline": "Nits",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-03-03T22:21:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5fac36baa9ad8bded5736aef036099d34510c8c8",
"body": null,
"is_bot": false,
"headline": "Bump",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-03-03T22:20:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5250c96e92a2e2f180555fbb32562bfa17853941",
"body": null,
"is_bot": false,
"headline": "Remove \"But\"",
"author_name": "Frank Denis",
"author_login": "jedisct1",
"committed_at": "2025-03-03T22:20:01Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 10,
"commits_last_year": 69,
"latest_release_at": "2026-07-30T15:59:11Z",
"latest_release_tag": "0.13.0",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 14,
"days_since_latest_release": 1,
"mean_days_between_releases": 203.1
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "jwt-simple",
"exists": true,
"license": "ISC",
"keywords": [
"json",
"authentication",
"jwt",
"jws",
"tokens",
"wasm",
"api-bindings",
"web-programming",
"cryptography"
],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/jwt-simple",
"is_deprecated": false,
"latest_version": "0.13.0",
"repository_url": "https://github.com/jedisct1/rust-jwt-simple",
"versions_count": 71,
"total_downloads": 5602868,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 267853,
"first_published_at": "2020-08-28T19:36:55.373261Z",
"latest_published_at": "2026-07-30T15:55:31.837469Z",
"latest_version_yanked": false,
"days_since_latest_publish": 1
}
]
},
"popularity": {
"forks": 64,
"stars": 278,
"watchers": 2,
"fork_history": {
"days": [
{
"date": "2020-08-31",
"count": 1
},
{
"date": "2020-09-01",
"count": 1
},
{
"date": "2020-10-12",
"count": 1
},
{
"date": "2020-11-03",
"count": 1
},
{
"date": "2020-12-25",
"count": 1
},
{
"date": "2021-03-02",
"count": 1
},
{
"date": "2021-04-06",
"count": 1
},
{
"date": "2021-05-06",
"count": 1
},
{
"date": "2021-05-26",
"count": 1
},
{
"date": "2021-08-11",
"count": 1
},
{
"date": "2021-11-09",
"count": 1
},
{
"date": "2021-12-12",
"count": 1
},
{
"date": "2022-01-09",
"count": 1
},
{
"date": "2022-03-30",
"count": 1
},
{
"date": "2022-04-19",
"count": 1
},
{
"date": "2022-05-10",
"count": 1
},
{
"date": "2022-05-22",
"count": 1
},
{
"date": "2022-05-23",
"count": 1
},
{
"date": "2022-05-31",
"count": 1
},
{
"date": "2022-06-06",
"count": 1
},
{
"date": "2022-06-23",
"count": 1
},
{
"date": "2022-07-15",
"count": 1
},
{
"date": "2022-07-28",
"count": 1
},
{
"date": "2022-08-02",
"count": 1
},
{
"date": "2022-08-10",
"count": 1
},
{
"date": "2022-08-14",
"count": 1
},
{
"date": "2022-09-02",
"count": 1
},
{
"date": "2022-10-03",
"count": 1
},
{
"date": "2022-10-25",
"count": 1
},
{
"date": "2022-11-02",
"count": 1
},
{
"date": "2022-11-19",
"count": 1
},
{
"date": "2023-01-30",
"count": 1
},
{
"date": "2023-02-10",
"count": 1
},
{
"date": "2023-03-02",
"count": 1
},
{
"date": "2023-03-20",
"count": 1
},
{
"date": "2023-03-30",
"count": 1
},
{
"date": "2023-05-10",
"count": 1
},
{
"date": "2023-05-16",
"count": 1
},
{
"date": "2023-07-12",
"count": 1
},
{
"date": "2023-08-29",
"count": 1
},
{
"date": "2023-10-24",
"count": 1
},
{
"date": "2023-12-15",
"count": 1
},
{
"date": "2023-12-29",
"count": 1
},
{
"date": "2024-01-13",
"count": 1
},
{
"date": "2024-01-18",
"count": 1
},
{
"date": "2024-02-03",
"count": 1
},
{
"date": "2024-02-19",
"count": 2
},
{
"date": "2024-07-19",
"count": 1
},
{
"date": "2024-07-25",
"count": 1
},
{
"date": "2024-12-19",
"count": 1
},
{
"date": "2025-01-08",
"count": 1
},
{
"date": "2025-01-28",
"count": 1
},
{
"date": "2025-01-29",
"count": 1
},
{
"date": "2025-02-27",
"count": 1
},
{
"date": "2025-03-04",
"count": 1
},
{
"date": "2025-04-20",
"count": 1
},
{
"date": "2025-10-25",
"count": 1
},
{
"date": "2025-10-30",
"count": 1
},
{
"date": "2026-04-09",
"count": 1
},
{
"date": "2026-04-18",
"count": 1
},
{
"date": "2026-04-23",
"count": 1
}
],
"complete": true,
"collected": 62,
"total_forks": 64
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"Cargo.toml"
],
"largest_source_bytes": 57016,
"source_files_sampled": 24,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"Cargo.toml"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"crates"
],
"dependencies": [
{
"name": "anyhow",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.0.104"
},
{
"name": "blake2b_simd",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.0.4"
},
{
"name": "binstring",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.1.7"
},
{
"name": "ciborium",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.2.2"
},
{
"name": "coarsetime",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.1.37"
},
{
"name": "ct-codecs",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.1.7"
},
{
"name": "ed25519-compact",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.3.1"
},
{
"name": "hmac-sha1-compact",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.1.7"
},
{
"name": "hmac-sha256",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.1.14"
},
{
"name": "hmac-sha512",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.1.12"
},
{
"name": "k256",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.14.0"
},
{
"name": "p256",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.14.0"
},
{
"name": "p384",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.14.0"
},
{
"name": "rand",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10.2"
},
{
"name": "serde",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.0.229"
},
{
"name": "serde_json",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.0.151"
},
{
"name": "thiserror",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.0.19"
},
{
"name": "zeroize",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.9.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 15,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 64,
"closed_unmerged_prs": 50
},
"bus_factor": 1,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "jedisct1",
"commits": 360,
"avatar_url": "https://avatars.githubusercontent.com/u/124872?v=4"
},
{
"type": "User",
"login": "sabify",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/3974920?v=4"
},
{
"type": "User",
"login": "agrinman",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/356333?v=4"
},
{
"type": "User",
"login": "Trundle",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/332418?v=4"
},
{
"type": "User",
"login": "nox",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/123095?v=4"
},
{
"type": "User",
"login": "cdelmas",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/5180763?v=4"
},
{
"type": "User",
"login": "IsraelZeromski",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/45366795?v=4"
},
{
"type": "User",
"login": "jjbarr",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/1876494?v=4"
},
{
"type": "User",
"login": "nthuemmel",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/28763519?v=4"
},
{
"type": "User",
"login": "seanpianka",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/15352684?v=4"
}
],
"contributors_sampled": 12,
"top_contributor_share": 0.968
},
"quality_signals": {
"has_ci": true,
"has_tests": false,
"ci_workflows": [
"ci.yml",
"issues.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 3 contributing companies or organizations -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 9,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "1887cdf9d22e6ee6fa2332e158331387043779a9",
"ran_at": "2026-07-31T23:09:23Z",
"aggregate_score": 5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-31T05:03:46Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2025-04-19T09:01:42Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/jedisct1/rust-jwt-simple",
"host": "github.com",
"name": "rust-jwt-simple",
"owner": "jedisct1"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"security": 50,
"vitality": 77,
"community": 60,
"governance": 63,
"engineering": 44
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 77,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"commits_last_year": 69,
"human_commit_share": 1,
"days_since_last_push": 1,
"active_weeks_last_year": 14
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "14/52 weeks with commits",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 14
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "69 commits in the last year",
"points": 16.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 69
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 84,
"inputs": {
"releases_count": 10,
"latest_release_tag": "0.13.0",
"releases_from_tags": false,
"days_since_latest_release": 1,
"mean_days_between_releases": 203.1
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "10 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 10
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~203.1 days",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 203.1
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 2,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 2 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 2
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 60,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"forks": 64,
"stars": 278,
"watchers": 2,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "278 stars",
"points": 39.6,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 278
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "64 forks",
"points": 15,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 64
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "2 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 2
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "at_risk",
"name": "Community health",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "license file present, not a recognized license",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "license_custom",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "excellent",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 91,
"inputs": {
"packages": [
"jwt-simple"
],
"dependents": null,
"ecosystems": "crates",
"total_downloads": 5602868,
"monthly_downloads": 267853
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "267,853 downloads/month across crates",
"points": 72.4,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 267853,
"ecosystems": "crates"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 63,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 33,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 12,
"top_contributor_share": 0.968
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 97% of commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 97
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "12 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 12
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"merged_prs": 15,
"open_issues": 0,
"closed_issues": 64,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 50
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "15/65 decided PRs merged",
"points": 8.8,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 15,
"decided": 65
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 75,
"inputs": {
"followers": 4316,
"owner_type": "User",
"is_verified": null,
"owner_login": "jedisct1",
"public_repos": 518,
"account_age_days": 6169
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "4,316 followers of jedisct1",
"points": 25,
"status": "met",
"details": [
{
"code": "owner_followers",
"params": {
"count": 4316,
"login": "jedisct1"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "518 public repos, account ~16 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 518
}
},
{
"code": "account_age_years",
"params": {
"years": 16
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"jwt-simple"
],
"ecosystems": "crates",
"any_deprecated": false,
"min_days_since_publish": 1
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on crates",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "crates"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 1 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 1
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "71 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 71
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 44,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 30,
"inputs": {
"has_ci": true,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [
"jwt",
"rust",
"tokens",
"authentication",
"web",
"json",
"jsonwebtokens",
"simple",
"crypto",
"okta",
"auth0",
"api",
"jws"
],
"has_wiki": false,
"homepage": "https://crates.io/crates/jwt-simple",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://crates.io/crates/jwt-simple",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "13 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 13
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 50,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 50,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 12
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 35,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "critical",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 11,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.2,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "20 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 10.7,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 20,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 29,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Cargo.toml (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "Cargo.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Rust (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "dependency automation configured, none observed in the sampled commits",
"points": 5,
"status": "partial",
"details": [
{
"code": "dependency_bot_config_only",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Rust",
"largest_source_bytes": 57016,
"source_files_sampled": 24,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Rust (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/24 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 24,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.14.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-31T23:09:33.115556Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/jedisct1/rust-jwt-simple.svg",
"full_name": "jedisct1/rust-jwt-simple",
"license_state": "custom",
"license_spdx": null
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.14.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — crates.io.