takimoto3/app-attest erreicht einen Gesundheitsindex von 53 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Vitality (76/100) ab, am schwächsten bei Community & Adoption (29/100). Zuletzt heute aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
53
gesamt / 100
Mittel
Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
53
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Release-Rhythmus — ein Release etwa alle 94,8 Tage
0/10
OpenSSF Scorecard: Signed-Releases — keine Daten
Verwendete Eingangsdaten
releases_count
4
latest_release_tag
v1.1.0
releases_from_tags
nein
days_since_latest_release
0
mean_days_between_releases
94,8
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Direkte Abhängigkeiten ohne bekannte Advisories — keine direkte Abhängigkeit trägt ein bekanntes Advisory
0/25
Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar
0/40
Keine offenen Advisories — kein Advisory trägt ein Veröffentlichungsdatum
Verwendete Eingangsdaten
source
osv
advisories
2
affected_packages
2
assessed_packages
7
unassessed_packages
0
affected_by_severity
unknown 2
direct_affected_packages
0
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories, Keine offenen Advisories. Die verbleibenden Gewichte wurden renormalisiert. 7 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
Handhabbare Dateigrößen — 0/16 Quelldateien über 60 KB
Verwendete Eingangsdaten
primary_language
Go
largest_source_bytes
18.821
source_files_sampled
16
oversized_source_files
0
Eckdaten
5GitHub-Sterne
1Mitwirkende
64Commits, letzte 12 Monate
0Tage seit letztem Push
4Releases
1Bus-Faktor
0offene Issues
GoPaket-Ökosysteme
Warnungen zur Datenerhebung
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 2 ⇿
0Sterne
2Forks
2Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 1Minor 1Patch 0
Jeder Punkt umfasst 2 Tage.
OpenSSF Scorecard 3.6 / 10
3.6Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-07-26 12:36 UTC
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 4 direkte und 3 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
Registry
Paket
Version
Beziehung
Go
github.com/google/go-cmp
v0.7.0
direkt
Go
github.com/smallstep/pkcs7
v0.2.1
direkt
Go
github.com/takimoto3/appleapi-core
v0.2.0
direkt
Go
github.com/tenntenn/testtime
v0.3.2
direkt
Go
golang.org/x/crypto
v0.52.0
indirekt
Go
golang.org/x/net
v0.55.0
indirekt
Go
golang.org/x/text
v0.39.0
indirekt
Abhängigkeits-Advisories 2
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 7 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 2 tragen bekannte Advisories, davon 0 direkte.
Paket
Version
Beziehung
Schweregrad
Advisories
Behoben in
golang.org/x/crypto
v0.52.0
indirekt
unbekannt
1
—
golang.org/x/net
v0.55.0
indirekt
unbekannt
1
0.56.0
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 116,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 92888
},
"pushed_at": "2026-07-25T14:50:59Z",
"created_at": "2022-07-29T17:20:51Z",
"owner_type": "User",
"updated_at": "2026-07-25T14:48:23Z",
"description": "A server-side go package that validates both Apple app assertions and assertions.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "takimoto3",
"company": null,
"location": null,
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/744915?v=4",
"created_at": "2011-04-22T00:16:19Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 5574
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-25T14:50:59Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-07-18T03:43:26Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2025-10-31T11:45:13Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2025-10-14T07:21:29Z"
}
],
"recent_commits": [
{
"oid": "35c118e6d49bdf512f64f706e8e5a42414cd56c6",
"body": "feat(cbor): add ReadUnsafeTextString for zero-allocation text decoding",
"is_bot": false,
"headline": "Merge pull request #24 from takimoto3/cbor-zero-copy-string",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2026-07-25T14:48:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97b80f578e34a6ec03f054b410fe60ee1e536b6a",
"body": null,
"is_bot": false,
"headline": "fix(deps): update golang.org/x/text to v0.39.0 to fix vulnerability",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-25T14:44:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40498dd035d1732867efe4c50769bd71e6616a8a",
"body": "…testation",
"is_bot": false,
"headline": "feat(cbor): use ReadUnsafeTextString for map keys in assertion and at…",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-25T14:28:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93cf9f1e670a16f6bce09e942cb4b8cbda7b8bff",
"body": "security: upgrade golang.org/x/crypto to v0.52.0",
"is_bot": false,
"headline": "Merge pull request #23 from takimoto3/fix/crypto-vuln",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:38:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16366c3c059f0478d0c0027f3b5a07ccdfec5bb1",
"body": null,
"is_bot": false,
"headline": "security: upgrade golang.org/x/crypto to v0.52.0",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:33:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c8e53727838648825082c501d7ead98e69da032",
"body": "security: upgrade golang.org/x/net and set toolchain to go1.26.5",
"is_bot": false,
"headline": "Merge pull request #22 from takimoto3/fix/security-vulns",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:14:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d69f1141d9ebe964d1d69cb76b35bf22eadc1fa",
"body": null,
"is_bot": false,
"headline": "ci: specify Go version 1.26.5 explicitly to fix overlay error",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:09:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b9a8a5777606e028e1dd270221444678b200f9d",
"body": null,
"is_bot": false,
"headline": "ci: upgrade setup-go to v5 to support toolchain directive",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:07:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f5c8a2b02ac4a531f0c2102c8c08ee77cca73f7",
"body": null,
"is_bot": false,
"headline": "security: upgrade golang.org/x/net and set toolchain to go1.26.5",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T04:57:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1cc464102a4476bdc1ebc27e89d001df9127ac44",
"body": "…from-initializer\n\ndocs(fraud): add comment to NewClientFromInitializer\n\nAdds a clarifying comment to the NewClientFromInitializer function in fraud/client.go.",
"is_bot": false,
"headline": "Merge pull request #21 from takimoto3/doc/add-comment-for-new-client-…",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-15T07:15:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "feb312a7222f756fefceccd93c3fb602aef4903a",
"body": null,
"is_bot": false,
"headline": "docs(fraud): add comment to NewClientFromInitializer",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-15T06:59:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01c7eded8d762439eb418baf6ae1e62bc0d8c23b",
"body": "feat(fraud): Allow passing\n HTTPClientInitializer to NewClient",
"is_bot": false,
"headline": "Merge pull request #20 from takimoto3/feat/custom-http-client",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-15T06:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c34c7a7495ef42514ace444382ff92903c0fdaf6",
"body": "Add NewClientFromInitializer to allow for customization of the http.Client used by the fraud.Client.\n\nThe existing NewClient function is preserved for backward compatibility and now calls NewClientFromInitializer with the default http client initializer.\n\nThis change enables users to provide their own http.Client with custom configurations, such as timeouts or transport settings, without introducing a breaking change.",
"is_bot": false,
"headline": "feat(fraud): Allow passing HTTPClientInitializer to NewClient",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-15T06:26:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "192b66d89f993f6be656593fe3ce8f7874ae7dd5",
"body": "Refactor: Update fraud client tests for Do method and auth header assertion\n\nThis pull request refactors the fraud client tests to improve clarity and accuracy.\n\nKey Changes:\n\nTest Function Renaming: The test function TestClient_Post in fraud/client_test.go has been renamed to TestClient_Do.\nThis ch\n[…]\nchanges enhance the reliability and readability of the fraud client tests, ensuring that the Client.Do method's\nbehavior, particularly regarding authentication header handling, is correctly validated.",
"is_bot": false,
"headline": "Merge pull request #19 from takimoto3/refactor/fraud-client-test",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-06T14:10:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b29905fcf616d36ec8585242848912f070d8c500",
"body": "…ertion",
"is_bot": false,
"headline": "Refactor: Update fraud client tests for Do method and auth header ass…",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-06T14:02:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d30d3fa2d8384a3fad8015109f6ab21f123b33f5",
"body": "refactor(fraud): Hide inner client in fraud.Client\n\nThis PR refactors the fraud.Client to improve encapsulation.\n\nThe fraud.Client previously embedded the appleapi.Client, which exposed all of its methods and fields. This made the public API of fraud.Client larger than necessary and could lead to co\n[…]\nternal state of the client without polluting the public API.\nThe Do method was renamed from Post to better reflect its purpose.\nThis change makes the fraud.Client more robust and easier to understand.",
"is_bot": false,
"headline": "Merge pull request #18 from takimoto3/refactor/hide-inner-client",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-06T08:24:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "080caa9181d111c6272902a9a7238f40bb17fd28",
"body": "The `fraud.Client` struct was refactored to hide the `appleapi.Client`\nby making it a private `inner` field.\n\nThis change improves encapsulation and makes the API of `fraud.Client`\nclearer.\n\nTest-only accessor methods were added to `client_internal_test.go` to\nallow testing of the internal state of the client.",
"is_bot": false,
"headline": "refactor(fraud): Hide inner client in fraud.Client",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-06T08:20:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e4510d8f3b67e81cc892d41201f8f97da8aa9e6",
"body": "feat: Add structured logging to fraud client\n\nThis pull request introduces structured logging to the fraud client, significantly improving our ability to debug and\nmonitor interactions with Apple's App Attest service.\n\nKey changes:\n\nUpgraded appleapi-core: The github.com/takimoto3/appleapi-core depe\n[…]\n. This\nchange allows the response handling logic to access the client's configured logger, ensuring consistent logging\nbehavior.\nThese changes make the fraud client more robust and easier to maintain.",
"is_bot": false,
"headline": "Merge pull request #17 from takimoto3/feature/add-logging",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-06T02:19:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4b51c0defe92a6fa4d73e73ce657f8d14606716a",
"body": "- Update appleapi-core to v0.2.0\n- Implement structured logging in the fraud client for better error handling and debugging.\n- Refactor handleResponse to be a method of the Client struct to access the logger.",
"is_bot": false,
"headline": "feat: Add structured logging to fraud client",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-06T02:14:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de3f737b59a0d3fb4d5cf503c3f9c1eb1d445f00",
"body": "feat(fraud): Add fraud risk assessment feature\n\nThis pull request introduces the fraud risk assessment feature and updates the documentation.\n\nChanges\n\nImplements the client and receipt parsing logic to assess fraud risk by communicating with Apple's App Attest server.\nAdds a new fraud/receipt packa\n[…]\n and verifying App Attest receipts.\nUpdates README.md to document the new feature, including usage examples and a new \"Features\" section.\nBumps the required Go version to 1.24 in go.mod and README.md.",
"is_bot": false,
"headline": "Merge pull request #16 from takimoto3/feature/fraud-assessment",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:28:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fa62dc88c9091382e494554bfc7b3ff104acb80b",
"body": "- Adds Features section and documentation for fraud risk assessment.\n- Updates Go version badge and system requirements to 1.24.\n- Refines tokenProvider initialization example.\n- Removes Third-Party Attributions and moves test data attribution to Acknowledgements.",
"is_bot": false,
"headline": "docs: Update README with fraud assessment feature and Go version",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:24:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cddf0af52ea431ea971358cb0aabb71cbc6dfa1c",
"body": "- Introduces fraud/receipt package for parsing and verifying App Attest receipts.\n- Includes ASN.1 attribute parsing and risk metric extraction.",
"is_bot": false,
"headline": "feat(fraud): Add receipt parsing and verification package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:14:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e238eec2b32208a54be91ff38fe5ad0fc843670",
"body": "- Updates fraud client and its tests.\n- Bumps Go version in go.mod.",
"is_bot": false,
"headline": "feat(fraud): Update client and tests for fraud assessment",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:13:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3883460c481291b3cb23f92574e186b737f9ee7f",
"body": null,
"is_bot": false,
"headline": "feat: Add fraud client package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T07:20:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac6967f65080a2f983172ae5ea15c83f36df8cf1",
"body": "chore: Add .vscode to .gitignore\n\nThis pull request adds .vscode/ to the .gitignore file.\n\nThis prevents IDE-specific files from being committed to the repository, helping to keep the repository clean from\nlocal development environment configurations.",
"is_bot": false,
"headline": "Merge pull request #15 from takimoto3/chore/add-vscode-gitignore",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-29T10:56:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a144fe70b76457e101f9b9398852408526df388b",
"body": null,
"is_bot": false,
"headline": "chore: Add .vscode to .gitignore",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T10:50:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c870783e8f8618d4b315cb7e278786beab578b7",
"body": "…-correction\n\nfix: Correct NewAttestationService signature and improve certs loading\n\nThis pull request addresses two main points:\n\nCorrected NewAttestationService signature:\nThe NewAttestationService function in attestation.go no longer returns an error, as it always returned nil.\nThe signature has\n[…]\no handle .cer files more robustly, supporting PEM, multiple DER, and single DER certificate formats. A new test file certs/certs_test.go has been added to cover the functionality of the certs package.",
"is_bot": false,
"headline": "Merge pull request #14 from takimoto3/fix/add-certs-package-signature…",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-29T07:54:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "742d1d190256cd51ca77470916e968b174b3295a",
"body": null,
"is_bot": false,
"headline": "fix: Correct NewAttestationService signature",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T07:37:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d41c6b1f44e04024ee2e96d1abd6525407e059e5",
"body": null,
"is_bot": false,
"headline": "feat: Improve certs loading and add tests",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T07:35:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5cb0aac4ffb36c36f4f4339c8b3558cf8a77dc9",
"body": " feat: Add certs package and refactor AttestationService\n\nThis pull request introduces a new certs package for loading certificates and refactors AttestationService to use dependency injection.\n\nChanges:\n\nAdded a new certs package with a LoadCertFiles function to load multiple certificate files (.pem or .cer).\nRefactored NewAttestationService to accept a *x509.CertPool as an argument, making it more modular and easier to test.\nUpdated the usage example in README.md to reflect the new API.",
"is_bot": false,
"headline": "Merge pull request #13 from takimoto3/feature/add-certs-package",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-29T03:47:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2d04a71008d12be33b6bf729284dc4417666480",
"body": null,
"is_bot": false,
"headline": "feat: Add certs package and refactor AttestationService",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T03:43:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dadb26b573b0c959ba7784f32824f57acf8b5efb",
"body": null,
"is_bot": false,
"headline": "style: Move testdata back to root directory",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-28T08:34:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e8d7edbee6baa2e4558e3539ef4db7b952a330e",
"body": "refactor: Move test data and utilities to testutils package\n\nThis pull request refactors the test data handling by introducing a new testutils package.\n\nChanges:\n\nCreated a testutils package to centralize test-related utility functions and data.\nMoved the testdata directory into the testutils packag\n[…]\nd assertion_test.go and attestation_test.go to use the new testutils package.\nThis change improves the organization of the test code and makes it easier to share test data across different test files.",
"is_bot": false,
"headline": "Merge pull request #12 from takimoto3/refactor/test-utils",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-28T07:11:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ebcc03e862704fc775d97ad08360b3e8f57f13f8",
"body": null,
"is_bot": false,
"headline": "refactor: Move test data and utilities to testutils package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-28T07:01:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ff165fd53517ac1f86c47a15214875c101def50",
"body": "Refactor/attestation init change\n\nOverview\n\nThis PR refactors the initialization of AttestationService to improve efficiency and updates related documentation and test utilities.\n\nChanges\n\nattestation.go:\nIntroduced NewAttestationService constructor to initialize x509.CertPool from the root CA file \n[…]\nlization.\nTo maintain a clean repository by ignoring macOS-specific files.\nTo keep documentation up-to-date with code changes.\nTo centralize and improve the reusability of test data loading utilities.",
"is_bot": false,
"headline": "Merge pull request #11 from takimoto3/refactor/attestation-init-change",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-22T09:44:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7aa2ae2806ff81cdcb5d058cb6a2edaf6d787972",
"body": "- Move DecodeB64 and LoadTestData from test files to attest package.\n- Update test files to use attest.DecodeB64 and attest.LoadTestData.\n- Refactor LoadTestData to accept multiple file paths for flexibility.",
"is_bot": false,
"headline": "refactor: Move test data loaders to attest package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-22T08:10:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "815746758ecf1ff49713a5f4e40f025428f55753",
"body": "- Add NewAttestationService constructor to initialize x509.CertPool\n from root CA file only once.\n- Modify AttestationService struct to hold the pre-loaded CertPool.\n- Update Verify method to use the pre-loaded CertPool, improving efficiency.",
"is_bot": false,
"headline": "refactor: Initialize AttestationService CertPool once",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-22T04:06:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ba120162d83683f92ed0ccd99d715702868dcfa",
"body": null,
"is_bot": false,
"headline": "chore: Add .DS_Store to .gitignore",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-22T03:18:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2ab587c5d2bd600d7507ac220be91a9137a8b26",
"body": "chore: Consolidate third-party licenses into CREDITS file\n\nOverview\n\nTo improve the management of third-party licenses in the project, individual LICENSE.* files have been\nremoved and consolidated into a single CREDITS file.\n\nChanges\n\nGenerated license information for dependent libraries based on go\n[…]\nse display on GitHub and clearly distinguish between the project's main license\nand the licenses of dependent libraries.\nTo centralize third-party license information and facilitate easier management.",
"is_bot": false,
"headline": "Merge pull request #10 from takimoto3/chore/consolidate-licenses",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-17T04:59:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa4ce966ba040d9729db6f0eb12dda1d636a203b",
"body": "Generated CREDITS file using gocredits and manually added\nLICENSE.devicecheck-appattest content. Removed individual\nLICENSE.* files to simplify license management and\nimprove GitHub's license detection.",
"is_bot": false,
"headline": "chore: Consolidate third-party licenses into CREDITS file",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-17T04:39:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4063c700a063ef2e01095d4f47b6898ef3fbf4a4",
"body": "feat(cbor): Replace cbor_go with custom CBOR decoder\n\nReplace the external github.com/brianolson/cbor_go library with a new, custom-built CBOR decoder.\n\nThe new decoder is implemented in the cbor package and provides basic CBOR decoding functionalities.\n\nKey changes include:\n\nIntroduced a manual Unm\n[…]\n the UnmarshalCBOR methods to ensure correctness and measure performance.\nUpdated existing tests to use the new UnmarshalCBOR methods.\nRemoved the github.com/brianolson/cbor_go dependency from go.mod.",
"is_bot": false,
"headline": "Merge pull request #9 from takimoto3/feat/custom-cbor-decoder",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-16T12:03:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f8d190051b2a70d56032ec5bed2ac244f9ecbe5",
"body": "Replace the external `github.com/brianolson/cbor_go` library with a new, custom-built CBOR decoder.\n\nThe new decoder is implemented in the `cbor` package and provides basic CBOR decoding functionalities.\n\nKey changes include:\n- Introduced a manual `UnmarshalCBOR` method for `AssertionObject` and `At\n[…]\nhalCBOR` methods to ensure correctness and measure performance.\n- Updated existing tests to use the new `UnmarshalCBOR` methods.\n- Removed the `github.com/brianolson/cbor_go` dependency from `go.mod`.",
"is_bot": false,
"headline": "feat(cbor): Replace cbor_go with custom CBOR decoder",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-16T11:54:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ea1a75f4f593cd069229bc4a8fd7f5946c8a6ad8",
"body": "chore: Authenticator Unmarshal Refinements and Module Cleanup\n\nThis pull request introduces several refinements to the authenticator module and cleans up unused Go modules.\n\nKey changes include:\n\nAuthenticator Unmarshal Improvements:\nRefactored HasAttestedCredentialData method for clarity.\nImproved \n[…]\n its usage has been replaced by standard library functions.\nThese changes aim to improve the reliability, maintainability, and clarity of the authenticator module and the overall project dependencies.",
"is_bot": false,
"headline": "Merge pull request #8 from takimoto3/chore/authenticator-refinements",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-15T11:53:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "98291182da48dd8474aa30d2d73444d70f824135",
"body": "- Removed github.com/pkg/errors as it is no longer needed after migrating to standard library error handling.\n- Removed golang.org/x/crypto as its usage has been replaced by standard library functions.",
"is_bot": false,
"headline": "chore: Clean up unused modules in go.mod and go.sum",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T11:22:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b06d519855aa49b3733c98170e77ef7f301faec",
"body": "- Enhance HasAttestedCredentialData method for clarity.\n- Improve error messages for better debugging.\n- Add new test cases.\n- Enhance code readability and maintainability in authenticator.go.",
"is_bot": false,
"headline": "fix: Minor improvements and readability",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T11:15:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e5ea86c212a619bc4f060ddb83c98031c98eee4",
"body": "refactor: Go Version Update Compatibility and Code Cleanup\n\nThis pull request addresses Go version update compatibility and performs a comprehensive code cleanup.\n\nKey changes include:\n\nError Handling Migration: Migrated from github.com/pkg/errors to standard library errors and\nfmt.Errorf for improv\n[…]\no with the standard library's ecdsa.VerifyASN1 function, which is available since Go 1.15.\nThese changes enhance code maintainability, align with modern Go practices, and resolve deprecation warnings.",
"is_bot": false,
"headline": "Merge pull request #7 from takimoto3/refactor/go-version-update-compat",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-15T05:53:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b5d2ea759689d62beaca5e1230cf18165807442a",
"body": "- Migrated from github.com/pkg/errors to standard library error handling.\n- Replaced io/ioutil with os package functions.\n- Corrected IsEquals function to use errors.Is for proper error comparison.\n- Ensured error messages follow Go conventions (start with lowercase).\n- Replaced deprecated elliptic.Marshal with custom MarshalUncompressed function.\n- Replaced backported ecdsa.VerifyASN1 with standard library function.",
"is_bot": false,
"headline": "refactor: Go version update compatibility and code cleanup",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T05:42:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e77f4cc0da057b054ced5c4025883e1304d0663a",
"body": null,
"is_bot": false,
"headline": "docs: Refine and brush up README.md for improved clarity",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T04:24:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12648980e06cb4ed2e01319675e5ab595ed3d39a",
"body": " feat: Enhance Test Environment and Update Go Version to 1.23\n\nKey changes include:\n\nGo Version Update: Upgraded go.mod to Go 1.23, aligning with modern Go development practices.\nEnvironment Refactoring: Renamed the Development environment to Sandbox in attestation.go and\nrelated test files to match\n[…]\ntions, attribution for new third-party libraries (go-cmp, testtime), and\nreferences.\nThese changes aim to improve the reliability, maintainability, and clarity of the project's testing\ninfrastructure.",
"is_bot": false,
"headline": "Merge pull request #6 from takimoto3/feature/test-env-refresh",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-15T01:19:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "694731227dd8c15690246ea1873ff337637ba31e",
"body": "- Introduce testdata_loader_test.go to load new test data (ios-14.4.json).\n- Modify attestation_test.go and assertion_test.go to use the new loader and test data.\n- Integrate github.com/tenntenn/testtime for time manipulation in tests to handle certificate expiration.\n- Add LICENSE.testtime for test\n[…]\netailed testing instructions, attribution for go-cmp and testtime, and references.\n- Add test execution step to .github/workflows/go.yml.\n- Add testtime and govulncheck installation steps to CI setup.",
"is_bot": false,
"headline": "feat: Enable testing with new test data and testtime in CI",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T14:58:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aaaab836238218bef30bcadb050cb8ad5ac9eb5a",
"body": "Adds the go-cmp library for improved test assertions.\nAlso includes the license file and attribution in the README.",
"is_bot": false,
"headline": "feat: Add go-cmp dependency",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T11:33:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e72d048a7f316a30a51b20ad689efbdc1d772ab",
"body": "- Add test data for iOS 14.4 from veehaitch/devicecheck-appattest.\n- Add the corresponding Apache 2.0 license file.\n- Update README.md to include attribution.",
"is_bot": false,
"headline": "feat: Add test data from veehaitch/devicecheck-appattest",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T11:13:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ce5b56103bd69df60daa9b45c40749ea578b50b",
"body": "Match Apple documentation which uses \"Sandbox\" for the test environment.\nThe constant \"Development\" has been renamed to \"Sandbox\".",
"is_bot": false,
"headline": "refactor: Rename Development environment to Sandbox",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T11:02:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c6a0a473dc8b76b67c84d571d605fbd4bcaae672",
"body": "- Update go.mod to Go 1.23\n- Update Go version and installation instructions in README.md",
"is_bot": false,
"headline": "feat: Support Go 1.23",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T09:55:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8a7f1d330ae8b1c5a76eec10f0e170ee709e706",
"body": "- Add LICENSE.cbor_go file.\n- Update README.md to include cbor_go in Third-Party Attributions section.",
"is_bot": false,
"headline": "docs: Add license information for cbor_go library",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T06:27:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4b2798cd1c385d6a21a8135477cb7755cfb74e0",
"body": "ci: Add govulncheck and update Go version to 1.23",
"is_bot": false,
"headline": "Merge pull request #5 from takimoto3/feature/add-govulncheck",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-11T12:02:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efde6e3352f7e630200cd4024df8ed39bd380e77",
"body": null,
"is_bot": false,
"headline": "ci: Bump Go version to 1.23",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-11T11:53:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "216a950d96ca49eb686fba48a2939fd6cfd69eda",
"body": null,
"is_bot": false,
"headline": "ci: Bump Go version to 1.22",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-11T11:18:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78ebe9f2c670347f72dae6ce731c00eee46dda01",
"body": null,
"is_bot": false,
"headline": "ci: Add govulncheck and update Go version to 1.21",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-11T10:56:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8391ddf7f45683e3b6736b719694cd6070638aec",
"body": "Improve Project Maintenance",
"is_bot": false,
"headline": "Merge pull request #3 from takimoto3/feature/maintenance",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-11T10:43:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "277c13d0efd0577c6b4bda8811cad4ee9a5b72e4",
"body": "This reverts commit 66e6aefc04039557488d99e532a67fd0d1134590.",
"is_bot": false,
"headline": "Revert \"feat: Add govulncheck to CI\"",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-11T10:24:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0b1ec67098e97b8bd9bebd4150e6162a5a97bd4",
"body": null,
"is_bot": false,
"headline": "refactor: Relocate test certificate handling",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-10T08:13:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67b2e5f3f9537648392eee7d23046f1394e5690e",
"body": null,
"is_bot": false,
"headline": "chore: Tidy go.mod",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-10T07:52:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "66e6aefc04039557488d99e532a67fd0d1134590",
"body": null,
"is_bot": false,
"headline": "feat: Add govulncheck to CI",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-10T07:49:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f588663b2e7d128dc56fdec20f9382f54d30b9f0",
"body": null,
"is_bot": false,
"headline": "Remove unused struct",
"author_name": "takimoto3",
"author_login": null,
"committed_at": "2022-08-22T13:36:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "325e905f0e86f398ffbce3b376a80e37232a8573",
"body": null,
"is_bot": false,
"headline": "Create go.yml",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2022-08-05T18:20:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b54f227ce08550f74bfeecc0fb26b91fa7d20d4e",
"body": null,
"is_bot": false,
"headline": "first commit",
"author_name": "takimoto3",
"author_login": null,
"committed_at": "2022-07-29T17:21:26Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 4,
"commits_last_year": 64,
"latest_release_at": "2026-07-25T14:50:59Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 8,
"days_since_latest_release": 0,
"mean_days_between_releases": 94.8
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/takimoto3/app-attest",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/takimoto3/app-attest",
"is_deprecated": false,
"latest_version": "v1.1.0",
"repository_url": "https://github.com/takimoto3/app-attest",
"versions_count": 4,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-25T14:48:14Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 2,
"stars": 5,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2024-11-06",
"count": 1
},
{
"date": "2026-05-18",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 18821,
"source_files_sampled": 16,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 18
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5942"
],
"fixed_version": "0.56.0",
"advisory_count": 1,
"oldest_advisory_days": 11
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 2
},
"advisory_count": 2,
"affected_count": 2,
"assessed_count": 7,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/google/go-cmp",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.7.0"
},
{
"name": "github.com/smallstep/pkcs7",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.1"
},
{
"name": "github.com/takimoto3/appleapi-core",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/tenntenn/testtime",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.2"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/google/go-cmp",
"direct": true,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/pkcs7",
"direct": true,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/takimoto3/appleapi-core",
"direct": true,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/tenntenn/testtime",
"direct": true,
"version": "v0.3.2",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.39.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 7,
"direct_count": 4,
"indirect_count": 3
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 21,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 3
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "takimoto3",
"commits": 59,
"avatar_url": "https://avatars.githubusercontent.com/u/744915?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"go.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/13 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 7,
"reason": "9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "35c118e6d49bdf512f64f706e8e5a42414cd56c6",
"ran_at": "2026-07-26T12:36:59Z",
"aggregate_score": 3.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T14:48:53Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-25T14:48:15Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/takimoto3/app-attest",
"host": "github.com",
"name": "app-attest",
"owner": "takimoto3"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"security": 49,
"vitality": 76,
"community": 29,
"governance": 47,
"engineering": 61
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 76,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"commits_last_year": 64,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 8
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "8/52 weeks with commits",
"points": 5.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 8
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "64 commits in the last year",
"points": 16.3,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 64
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7",
"points": 7,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 4,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 94.8
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "4 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 4
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~94.8 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 94.8
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 29,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"forks": 2,
"stars": 5,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "5 stars",
"points": 9.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 5
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 47,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 63,
"inputs": {
"merged_prs": 21,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 3
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "21/24 decided PRs merged",
"points": 33.5,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 21,
"decided": 24
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/13 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"followers": 1,
"owner_type": "User",
"is_verified": null,
"owner_login": "takimoto3",
"public_repos": 10,
"account_age_days": 5574
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of takimoto3",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "takimoto3"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~15 yr old",
"points": 19.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 15
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/takimoto3/app-attest"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "4 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 4
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 61,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 49,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 36,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/13 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7",
"points": 5.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 7 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 7
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 2,
"affected_packages": 2,
"assessed_packages": 7,
"unassessed_packages": 0,
"affected_by_severity": "unknown 2",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 7,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 58,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.925,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "62 of 67 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 62,
"sampled": 67
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "go.mod (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "go.mod"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 67",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 67
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 18821,
"source_files_sampled": 16,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/16 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 16,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-26T12:37:13.104998Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/takimoto3/app-attest.svg",
"full_name": "takimoto3/app-attest",
"license_state": "standard",
"license_spdx": "MIT"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit takimoto3/app-attest teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
