takimoto3/app-attest tiene un índice de salud de 53 sobre 100, lo que lo sitúa en la banda Moderado. Su puntuación más alta es Vitality (76/100) y la más baja, Community & Adoption (29/100). Se actualizó por última vez hoy. Una sola persona concentra la mayor parte del trabajo reciente.
53
global / 100
Moderado
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
53
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.
Dependencias directas libres de avisos conocidos — ninguna dependencia directa tiene un aviso conocido
0/25
Dependencias indirectas libres de avisos conocidos — el conjunto transitivo no es separable de las dependencias de desarrollo y prueba en este alcance
0/40
Sin avisos pendientes — ningún aviso tiene fecha de publicación
Datos de entrada utilizados
source
osv
advisories
2
affected_packages
2
assessed_packages
7
unassessed_packages
0
affected_by_severity
unknown 2
direct_affected_packages
0
Excluidos de la puntuación (sin datos o no aplicable): Dependencias indirectas libres de avisos conocidos, Sin avisos pendientes. Los pesos restantes se han renormalizado. Se cotejaron 7 dependencias resueltas con OSV. Este repositorio no publica ningún paquete que el índice resuelva, por lo que se evaluó en su lugar el grafo de dependencias del repositorio. Ese grafo mezcla fijaciones de desarrollo y prueba con las dependencias distribuidas, de modo que solo se puntúan las dependencias declaradas en tiempo de ejecución; los hallazgos transitivos se informan como contexto y quedan excluidos de la puntuación. No se analiza la alcanzabilidad.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
Código verificable por tipos — Go (tipado estático)
55/55
Tamaños de archivo manejables — 0/16 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_language
Go
largest_source_bytes
18.821
source_files_sampled
16
oversized_source_files
0
Datos clave
5estrellas de GitHub
1contribuidores
64commits en los últimos 12 meses
0días desde el último push
4versiones publicadas
1factor bus
0issues abiertas
Goecosistemas de paquetes
Advertencias de recopilación de datos
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Más detalle
Historial de estrellas y forks 0 ★ / 2 ⇿
0Estrellas
2Forks
2Versiones
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
Mayor 1Menor 1Parche 0
Cada punto abarca 2 días.
OpenSSF Scorecard 3.6 / 10
3.6agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-26 12:36 UTC
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 4 paquetes directos y 3 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
Registro
Paquete
Versión
Relación
Go
github.com/google/go-cmp
v0.7.0
directa
Go
github.com/smallstep/pkcs7
v0.2.1
directa
Go
github.com/takimoto3/appleapi-core
v0.2.0
directa
Go
github.com/tenntenn/testtime
v0.3.2
directa
Go
golang.org/x/crypto
v0.52.0
indirecta
Go
golang.org/x/net
v0.55.0
indirecta
Go
golang.org/x/text
v0.39.0
indirecta
Avisos de dependencias 2
Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 7 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 2 tienen avisos conocidos, de los cuales 0 son directas.
Paquete
Versión
Relación
Gravedad
Avisos
Corregido en
golang.org/x/crypto
v0.52.0
indirecta
desconocida
1
—
golang.org/x/net
v0.55.0
indirecta
desconocida
1
0.56.0
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 116,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 92888
},
"pushed_at": "2026-07-25T14:50:59Z",
"created_at": "2022-07-29T17:20:51Z",
"owner_type": "User",
"updated_at": "2026-07-25T14:48:23Z",
"description": "A server-side go package that validates both Apple app assertions and assertions.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "takimoto3",
"company": null,
"location": null,
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/744915?v=4",
"created_at": "2011-04-22T00:16:19Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 5574
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-25T14:50:59Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-07-18T03:43:26Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2025-10-31T11:45:13Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2025-10-14T07:21:29Z"
}
],
"recent_commits": [
{
"oid": "35c118e6d49bdf512f64f706e8e5a42414cd56c6",
"body": "feat(cbor): add ReadUnsafeTextString for zero-allocation text decoding",
"is_bot": false,
"headline": "Merge pull request #24 from takimoto3/cbor-zero-copy-string",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2026-07-25T14:48:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97b80f578e34a6ec03f054b410fe60ee1e536b6a",
"body": null,
"is_bot": false,
"headline": "fix(deps): update golang.org/x/text to v0.39.0 to fix vulnerability",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-25T14:44:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40498dd035d1732867efe4c50769bd71e6616a8a",
"body": "…testation",
"is_bot": false,
"headline": "feat(cbor): use ReadUnsafeTextString for map keys in assertion and at…",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-25T14:28:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93cf9f1e670a16f6bce09e942cb4b8cbda7b8bff",
"body": "security: upgrade golang.org/x/crypto to v0.52.0",
"is_bot": false,
"headline": "Merge pull request #23 from takimoto3/fix/crypto-vuln",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:38:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16366c3c059f0478d0c0027f3b5a07ccdfec5bb1",
"body": null,
"is_bot": false,
"headline": "security: upgrade golang.org/x/crypto to v0.52.0",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:33:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c8e53727838648825082c501d7ead98e69da032",
"body": "security: upgrade golang.org/x/net and set toolchain to go1.26.5",
"is_bot": false,
"headline": "Merge pull request #22 from takimoto3/fix/security-vulns",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:14:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d69f1141d9ebe964d1d69cb76b35bf22eadc1fa",
"body": null,
"is_bot": false,
"headline": "ci: specify Go version 1.26.5 explicitly to fix overlay error",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:09:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b9a8a5777606e028e1dd270221444678b200f9d",
"body": null,
"is_bot": false,
"headline": "ci: upgrade setup-go to v5 to support toolchain directive",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T05:07:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f5c8a2b02ac4a531f0c2102c8c08ee77cca73f7",
"body": null,
"is_bot": false,
"headline": "security: upgrade golang.org/x/net and set toolchain to go1.26.5",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2026-07-15T04:57:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1cc464102a4476bdc1ebc27e89d001df9127ac44",
"body": "…from-initializer\n\ndocs(fraud): add comment to NewClientFromInitializer\n\nAdds a clarifying comment to the NewClientFromInitializer function in fraud/client.go.",
"is_bot": false,
"headline": "Merge pull request #21 from takimoto3/doc/add-comment-for-new-client-…",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-15T07:15:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "feb312a7222f756fefceccd93c3fb602aef4903a",
"body": null,
"is_bot": false,
"headline": "docs(fraud): add comment to NewClientFromInitializer",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-15T06:59:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01c7eded8d762439eb418baf6ae1e62bc0d8c23b",
"body": "feat(fraud): Allow passing\n HTTPClientInitializer to NewClient",
"is_bot": false,
"headline": "Merge pull request #20 from takimoto3/feat/custom-http-client",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-15T06:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c34c7a7495ef42514ace444382ff92903c0fdaf6",
"body": "Add NewClientFromInitializer to allow for customization of the http.Client used by the fraud.Client.\n\nThe existing NewClient function is preserved for backward compatibility and now calls NewClientFromInitializer with the default http client initializer.\n\nThis change enables users to provide their own http.Client with custom configurations, such as timeouts or transport settings, without introducing a breaking change.",
"is_bot": false,
"headline": "feat(fraud): Allow passing HTTPClientInitializer to NewClient",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-15T06:26:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "192b66d89f993f6be656593fe3ce8f7874ae7dd5",
"body": "Refactor: Update fraud client tests for Do method and auth header assertion\n\nThis pull request refactors the fraud client tests to improve clarity and accuracy.\n\nKey Changes:\n\nTest Function Renaming: The test function TestClient_Post in fraud/client_test.go has been renamed to TestClient_Do.\nThis ch\n[…]\nchanges enhance the reliability and readability of the fraud client tests, ensuring that the Client.Do method's\nbehavior, particularly regarding authentication header handling, is correctly validated.",
"is_bot": false,
"headline": "Merge pull request #19 from takimoto3/refactor/fraud-client-test",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-06T14:10:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b29905fcf616d36ec8585242848912f070d8c500",
"body": "…ertion",
"is_bot": false,
"headline": "Refactor: Update fraud client tests for Do method and auth header ass…",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-06T14:02:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d30d3fa2d8384a3fad8015109f6ab21f123b33f5",
"body": "refactor(fraud): Hide inner client in fraud.Client\n\nThis PR refactors the fraud.Client to improve encapsulation.\n\nThe fraud.Client previously embedded the appleapi.Client, which exposed all of its methods and fields. This made the public API of fraud.Client larger than necessary and could lead to co\n[…]\nternal state of the client without polluting the public API.\nThe Do method was renamed from Post to better reflect its purpose.\nThis change makes the fraud.Client more robust and easier to understand.",
"is_bot": false,
"headline": "Merge pull request #18 from takimoto3/refactor/hide-inner-client",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-06T08:24:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "080caa9181d111c6272902a9a7238f40bb17fd28",
"body": "The `fraud.Client` struct was refactored to hide the `appleapi.Client`\nby making it a private `inner` field.\n\nThis change improves encapsulation and makes the API of `fraud.Client`\nclearer.\n\nTest-only accessor methods were added to `client_internal_test.go` to\nallow testing of the internal state of the client.",
"is_bot": false,
"headline": "refactor(fraud): Hide inner client in fraud.Client",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-06T08:20:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e4510d8f3b67e81cc892d41201f8f97da8aa9e6",
"body": "feat: Add structured logging to fraud client\n\nThis pull request introduces structured logging to the fraud client, significantly improving our ability to debug and\nmonitor interactions with Apple's App Attest service.\n\nKey changes:\n\nUpgraded appleapi-core: The github.com/takimoto3/appleapi-core depe\n[…]\n. This\nchange allows the response handling logic to access the client's configured logger, ensuring consistent logging\nbehavior.\nThese changes make the fraud client more robust and easier to maintain.",
"is_bot": false,
"headline": "Merge pull request #17 from takimoto3/feature/add-logging",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-11-06T02:19:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4b51c0defe92a6fa4d73e73ce657f8d14606716a",
"body": "- Update appleapi-core to v0.2.0\n- Implement structured logging in the fraud client for better error handling and debugging.\n- Refactor handleResponse to be a method of the Client struct to access the logger.",
"is_bot": false,
"headline": "feat: Add structured logging to fraud client",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-11-06T02:14:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de3f737b59a0d3fb4d5cf503c3f9c1eb1d445f00",
"body": "feat(fraud): Add fraud risk assessment feature\n\nThis pull request introduces the fraud risk assessment feature and updates the documentation.\n\nChanges\n\nImplements the client and receipt parsing logic to assess fraud risk by communicating with Apple's App Attest server.\nAdds a new fraud/receipt packa\n[…]\n and verifying App Attest receipts.\nUpdates README.md to document the new feature, including usage examples and a new \"Features\" section.\nBumps the required Go version to 1.24 in go.mod and README.md.",
"is_bot": false,
"headline": "Merge pull request #16 from takimoto3/feature/fraud-assessment",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:28:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fa62dc88c9091382e494554bfc7b3ff104acb80b",
"body": "- Adds Features section and documentation for fraud risk assessment.\n- Updates Go version badge and system requirements to 1.24.\n- Refines tokenProvider initialization example.\n- Removes Third-Party Attributions and moves test data attribution to Acknowledgements.",
"is_bot": false,
"headline": "docs: Update README with fraud assessment feature and Go version",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:24:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cddf0af52ea431ea971358cb0aabb71cbc6dfa1c",
"body": "- Introduces fraud/receipt package for parsing and verifying App Attest receipts.\n- Includes ASN.1 attribute parsing and risk metric extraction.",
"is_bot": false,
"headline": "feat(fraud): Add receipt parsing and verification package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:14:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e238eec2b32208a54be91ff38fe5ad0fc843670",
"body": "- Updates fraud client and its tests.\n- Bumps Go version in go.mod.",
"is_bot": false,
"headline": "feat(fraud): Update client and tests for fraud assessment",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T11:13:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3883460c481291b3cb23f92574e186b737f9ee7f",
"body": null,
"is_bot": false,
"headline": "feat: Add fraud client package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-31T07:20:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac6967f65080a2f983172ae5ea15c83f36df8cf1",
"body": "chore: Add .vscode to .gitignore\n\nThis pull request adds .vscode/ to the .gitignore file.\n\nThis prevents IDE-specific files from being committed to the repository, helping to keep the repository clean from\nlocal development environment configurations.",
"is_bot": false,
"headline": "Merge pull request #15 from takimoto3/chore/add-vscode-gitignore",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-29T10:56:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a144fe70b76457e101f9b9398852408526df388b",
"body": null,
"is_bot": false,
"headline": "chore: Add .vscode to .gitignore",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T10:50:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c870783e8f8618d4b315cb7e278786beab578b7",
"body": "…-correction\n\nfix: Correct NewAttestationService signature and improve certs loading\n\nThis pull request addresses two main points:\n\nCorrected NewAttestationService signature:\nThe NewAttestationService function in attestation.go no longer returns an error, as it always returned nil.\nThe signature has\n[…]\no handle .cer files more robustly, supporting PEM, multiple DER, and single DER certificate formats. A new test file certs/certs_test.go has been added to cover the functionality of the certs package.",
"is_bot": false,
"headline": "Merge pull request #14 from takimoto3/fix/add-certs-package-signature…",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-29T07:54:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "742d1d190256cd51ca77470916e968b174b3295a",
"body": null,
"is_bot": false,
"headline": "fix: Correct NewAttestationService signature",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T07:37:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d41c6b1f44e04024ee2e96d1abd6525407e059e5",
"body": null,
"is_bot": false,
"headline": "feat: Improve certs loading and add tests",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T07:35:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5cb0aac4ffb36c36f4f4339c8b3558cf8a77dc9",
"body": " feat: Add certs package and refactor AttestationService\n\nThis pull request introduces a new certs package for loading certificates and refactors AttestationService to use dependency injection.\n\nChanges:\n\nAdded a new certs package with a LoadCertFiles function to load multiple certificate files (.pem or .cer).\nRefactored NewAttestationService to accept a *x509.CertPool as an argument, making it more modular and easier to test.\nUpdated the usage example in README.md to reflect the new API.",
"is_bot": false,
"headline": "Merge pull request #13 from takimoto3/feature/add-certs-package",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-29T03:47:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2d04a71008d12be33b6bf729284dc4417666480",
"body": null,
"is_bot": false,
"headline": "feat: Add certs package and refactor AttestationService",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-29T03:43:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dadb26b573b0c959ba7784f32824f57acf8b5efb",
"body": null,
"is_bot": false,
"headline": "style: Move testdata back to root directory",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-28T08:34:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e8d7edbee6baa2e4558e3539ef4db7b952a330e",
"body": "refactor: Move test data and utilities to testutils package\n\nThis pull request refactors the test data handling by introducing a new testutils package.\n\nChanges:\n\nCreated a testutils package to centralize test-related utility functions and data.\nMoved the testdata directory into the testutils packag\n[…]\nd assertion_test.go and attestation_test.go to use the new testutils package.\nThis change improves the organization of the test code and makes it easier to share test data across different test files.",
"is_bot": false,
"headline": "Merge pull request #12 from takimoto3/refactor/test-utils",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-28T07:11:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ebcc03e862704fc775d97ad08360b3e8f57f13f8",
"body": null,
"is_bot": false,
"headline": "refactor: Move test data and utilities to testutils package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-28T07:01:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ff165fd53517ac1f86c47a15214875c101def50",
"body": "Refactor/attestation init change\n\nOverview\n\nThis PR refactors the initialization of AttestationService to improve efficiency and updates related documentation and test utilities.\n\nChanges\n\nattestation.go:\nIntroduced NewAttestationService constructor to initialize x509.CertPool from the root CA file \n[…]\nlization.\nTo maintain a clean repository by ignoring macOS-specific files.\nTo keep documentation up-to-date with code changes.\nTo centralize and improve the reusability of test data loading utilities.",
"is_bot": false,
"headline": "Merge pull request #11 from takimoto3/refactor/attestation-init-change",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-22T09:44:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7aa2ae2806ff81cdcb5d058cb6a2edaf6d787972",
"body": "- Move DecodeB64 and LoadTestData from test files to attest package.\n- Update test files to use attest.DecodeB64 and attest.LoadTestData.\n- Refactor LoadTestData to accept multiple file paths for flexibility.",
"is_bot": false,
"headline": "refactor: Move test data loaders to attest package",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-22T08:10:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "815746758ecf1ff49713a5f4e40f025428f55753",
"body": "- Add NewAttestationService constructor to initialize x509.CertPool\n from root CA file only once.\n- Modify AttestationService struct to hold the pre-loaded CertPool.\n- Update Verify method to use the pre-loaded CertPool, improving efficiency.",
"is_bot": false,
"headline": "refactor: Initialize AttestationService CertPool once",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-22T04:06:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ba120162d83683f92ed0ccd99d715702868dcfa",
"body": null,
"is_bot": false,
"headline": "chore: Add .DS_Store to .gitignore",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-22T03:18:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2ab587c5d2bd600d7507ac220be91a9137a8b26",
"body": "chore: Consolidate third-party licenses into CREDITS file\n\nOverview\n\nTo improve the management of third-party licenses in the project, individual LICENSE.* files have been\nremoved and consolidated into a single CREDITS file.\n\nChanges\n\nGenerated license information for dependent libraries based on go\n[…]\nse display on GitHub and clearly distinguish between the project's main license\nand the licenses of dependent libraries.\nTo centralize third-party license information and facilitate easier management.",
"is_bot": false,
"headline": "Merge pull request #10 from takimoto3/chore/consolidate-licenses",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-17T04:59:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa4ce966ba040d9729db6f0eb12dda1d636a203b",
"body": "Generated CREDITS file using gocredits and manually added\nLICENSE.devicecheck-appattest content. Removed individual\nLICENSE.* files to simplify license management and\nimprove GitHub's license detection.",
"is_bot": false,
"headline": "chore: Consolidate third-party licenses into CREDITS file",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-17T04:39:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4063c700a063ef2e01095d4f47b6898ef3fbf4a4",
"body": "feat(cbor): Replace cbor_go with custom CBOR decoder\n\nReplace the external github.com/brianolson/cbor_go library with a new, custom-built CBOR decoder.\n\nThe new decoder is implemented in the cbor package and provides basic CBOR decoding functionalities.\n\nKey changes include:\n\nIntroduced a manual Unm\n[…]\n the UnmarshalCBOR methods to ensure correctness and measure performance.\nUpdated existing tests to use the new UnmarshalCBOR methods.\nRemoved the github.com/brianolson/cbor_go dependency from go.mod.",
"is_bot": false,
"headline": "Merge pull request #9 from takimoto3/feat/custom-cbor-decoder",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-16T12:03:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f8d190051b2a70d56032ec5bed2ac244f9ecbe5",
"body": "Replace the external `github.com/brianolson/cbor_go` library with a new, custom-built CBOR decoder.\n\nThe new decoder is implemented in the `cbor` package and provides basic CBOR decoding functionalities.\n\nKey changes include:\n- Introduced a manual `UnmarshalCBOR` method for `AssertionObject` and `At\n[…]\nhalCBOR` methods to ensure correctness and measure performance.\n- Updated existing tests to use the new `UnmarshalCBOR` methods.\n- Removed the `github.com/brianolson/cbor_go` dependency from `go.mod`.",
"is_bot": false,
"headline": "feat(cbor): Replace cbor_go with custom CBOR decoder",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-16T11:54:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ea1a75f4f593cd069229bc4a8fd7f5946c8a6ad8",
"body": "chore: Authenticator Unmarshal Refinements and Module Cleanup\n\nThis pull request introduces several refinements to the authenticator module and cleans up unused Go modules.\n\nKey changes include:\n\nAuthenticator Unmarshal Improvements:\nRefactored HasAttestedCredentialData method for clarity.\nImproved \n[…]\n its usage has been replaced by standard library functions.\nThese changes aim to improve the reliability, maintainability, and clarity of the authenticator module and the overall project dependencies.",
"is_bot": false,
"headline": "Merge pull request #8 from takimoto3/chore/authenticator-refinements",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-15T11:53:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "98291182da48dd8474aa30d2d73444d70f824135",
"body": "- Removed github.com/pkg/errors as it is no longer needed after migrating to standard library error handling.\n- Removed golang.org/x/crypto as its usage has been replaced by standard library functions.",
"is_bot": false,
"headline": "chore: Clean up unused modules in go.mod and go.sum",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T11:22:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b06d519855aa49b3733c98170e77ef7f301faec",
"body": "- Enhance HasAttestedCredentialData method for clarity.\n- Improve error messages for better debugging.\n- Add new test cases.\n- Enhance code readability and maintainability in authenticator.go.",
"is_bot": false,
"headline": "fix: Minor improvements and readability",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T11:15:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e5ea86c212a619bc4f060ddb83c98031c98eee4",
"body": "refactor: Go Version Update Compatibility and Code Cleanup\n\nThis pull request addresses Go version update compatibility and performs a comprehensive code cleanup.\n\nKey changes include:\n\nError Handling Migration: Migrated from github.com/pkg/errors to standard library errors and\nfmt.Errorf for improv\n[…]\no with the standard library's ecdsa.VerifyASN1 function, which is available since Go 1.15.\nThese changes enhance code maintainability, align with modern Go practices, and resolve deprecation warnings.",
"is_bot": false,
"headline": "Merge pull request #7 from takimoto3/refactor/go-version-update-compat",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-15T05:53:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b5d2ea759689d62beaca5e1230cf18165807442a",
"body": "- Migrated from github.com/pkg/errors to standard library error handling.\n- Replaced io/ioutil with os package functions.\n- Corrected IsEquals function to use errors.Is for proper error comparison.\n- Ensured error messages follow Go conventions (start with lowercase).\n- Replaced deprecated elliptic.Marshal with custom MarshalUncompressed function.\n- Replaced backported ecdsa.VerifyASN1 with standard library function.",
"is_bot": false,
"headline": "refactor: Go version update compatibility and code cleanup",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T05:42:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e77f4cc0da057b054ced5c4025883e1304d0663a",
"body": null,
"is_bot": false,
"headline": "docs: Refine and brush up README.md for improved clarity",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-15T04:24:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12648980e06cb4ed2e01319675e5ab595ed3d39a",
"body": " feat: Enhance Test Environment and Update Go Version to 1.23\n\nKey changes include:\n\nGo Version Update: Upgraded go.mod to Go 1.23, aligning with modern Go development practices.\nEnvironment Refactoring: Renamed the Development environment to Sandbox in attestation.go and\nrelated test files to match\n[…]\ntions, attribution for new third-party libraries (go-cmp, testtime), and\nreferences.\nThese changes aim to improve the reliability, maintainability, and clarity of the project's testing\ninfrastructure.",
"is_bot": false,
"headline": "Merge pull request #6 from takimoto3/feature/test-env-refresh",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-15T01:19:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "694731227dd8c15690246ea1873ff337637ba31e",
"body": "- Introduce testdata_loader_test.go to load new test data (ios-14.4.json).\n- Modify attestation_test.go and assertion_test.go to use the new loader and test data.\n- Integrate github.com/tenntenn/testtime for time manipulation in tests to handle certificate expiration.\n- Add LICENSE.testtime for test\n[…]\netailed testing instructions, attribution for go-cmp and testtime, and references.\n- Add test execution step to .github/workflows/go.yml.\n- Add testtime and govulncheck installation steps to CI setup.",
"is_bot": false,
"headline": "feat: Enable testing with new test data and testtime in CI",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T14:58:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aaaab836238218bef30bcadb050cb8ad5ac9eb5a",
"body": "Adds the go-cmp library for improved test assertions.\nAlso includes the license file and attribution in the README.",
"is_bot": false,
"headline": "feat: Add go-cmp dependency",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T11:33:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e72d048a7f316a30a51b20ad689efbdc1d772ab",
"body": "- Add test data for iOS 14.4 from veehaitch/devicecheck-appattest.\n- Add the corresponding Apache 2.0 license file.\n- Update README.md to include attribution.",
"is_bot": false,
"headline": "feat: Add test data from veehaitch/devicecheck-appattest",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T11:13:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ce5b56103bd69df60daa9b45c40749ea578b50b",
"body": "Match Apple documentation which uses \"Sandbox\" for the test environment.\nThe constant \"Development\" has been renamed to \"Sandbox\".",
"is_bot": false,
"headline": "refactor: Rename Development environment to Sandbox",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T11:02:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c6a0a473dc8b76b67c84d571d605fbd4bcaae672",
"body": "- Update go.mod to Go 1.23\n- Update Go version and installation instructions in README.md",
"is_bot": false,
"headline": "feat: Support Go 1.23",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T09:55:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8a7f1d330ae8b1c5a76eec10f0e170ee709e706",
"body": "- Add LICENSE.cbor_go file.\n- Update README.md to include cbor_go in Third-Party Attributions section.",
"is_bot": false,
"headline": "docs: Add license information for cbor_go library",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-14T06:27:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4b2798cd1c385d6a21a8135477cb7755cfb74e0",
"body": "ci: Add govulncheck and update Go version to 1.23",
"is_bot": false,
"headline": "Merge pull request #5 from takimoto3/feature/add-govulncheck",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-11T12:02:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efde6e3352f7e630200cd4024df8ed39bd380e77",
"body": null,
"is_bot": false,
"headline": "ci: Bump Go version to 1.23",
"author_name": "Masato Takimoto",
"author_login": "takimoto3",
"committed_at": "2025-10-11T11:53:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "216a950d96ca49eb686fba48a2939fd6cfd69eda",
"body": null,
"is_bot": false,
"headline": "ci: Bump Go version to 1.22",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-11T11:18:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78ebe9f2c670347f72dae6ce731c00eee46dda01",
"body": null,
"is_bot": false,
"headline": "ci: Add govulncheck and update Go version to 1.21",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-11T10:56:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8391ddf7f45683e3b6736b719694cd6070638aec",
"body": "Improve Project Maintenance",
"is_bot": false,
"headline": "Merge pull request #3 from takimoto3/feature/maintenance",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2025-10-11T10:43:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "277c13d0efd0577c6b4bda8811cad4ee9a5b72e4",
"body": "This reverts commit 66e6aefc04039557488d99e532a67fd0d1134590.",
"is_bot": false,
"headline": "Revert \"feat: Add govulncheck to CI\"",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-11T10:24:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0b1ec67098e97b8bd9bebd4150e6162a5a97bd4",
"body": null,
"is_bot": false,
"headline": "refactor: Relocate test certificate handling",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-10T08:13:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67b2e5f3f9537648392eee7d23046f1394e5690e",
"body": null,
"is_bot": false,
"headline": "chore: Tidy go.mod",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-10T07:52:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "66e6aefc04039557488d99e532a67fd0d1134590",
"body": null,
"is_bot": false,
"headline": "feat: Add govulncheck to CI",
"author_name": "Masato Takimoto",
"author_login": null,
"committed_at": "2025-10-10T07:49:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f588663b2e7d128dc56fdec20f9382f54d30b9f0",
"body": null,
"is_bot": false,
"headline": "Remove unused struct",
"author_name": "takimoto3",
"author_login": null,
"committed_at": "2022-08-22T13:36:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "325e905f0e86f398ffbce3b376a80e37232a8573",
"body": null,
"is_bot": false,
"headline": "Create go.yml",
"author_name": "takimoto3",
"author_login": "takimoto3",
"committed_at": "2022-08-05T18:20:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b54f227ce08550f74bfeecc0fb26b91fa7d20d4e",
"body": null,
"is_bot": false,
"headline": "first commit",
"author_name": "takimoto3",
"author_login": null,
"committed_at": "2022-07-29T17:21:26Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 4,
"commits_last_year": 64,
"latest_release_at": "2026-07-25T14:50:59Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 8,
"days_since_latest_release": 0,
"mean_days_between_releases": 94.8
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/takimoto3/app-attest",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/takimoto3/app-attest",
"is_deprecated": false,
"latest_version": "v1.1.0",
"repository_url": "https://github.com/takimoto3/app-attest",
"versions_count": 4,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-25T14:48:14Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 2,
"stars": 5,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2024-11-06",
"count": 1
},
{
"date": "2026-05-18",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 18821,
"source_files_sampled": 16,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 18
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5942"
],
"fixed_version": "0.56.0",
"advisory_count": 1,
"oldest_advisory_days": 11
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 2
},
"advisory_count": 2,
"affected_count": 2,
"assessed_count": 7,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/google/go-cmp",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.7.0"
},
{
"name": "github.com/smallstep/pkcs7",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.1"
},
{
"name": "github.com/takimoto3/appleapi-core",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.2.0"
},
{
"name": "github.com/tenntenn/testtime",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.2"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/google/go-cmp",
"direct": true,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/pkcs7",
"direct": true,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/takimoto3/appleapi-core",
"direct": true,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/tenntenn/testtime",
"direct": true,
"version": "v0.3.2",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.39.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 7,
"direct_count": 4,
"indirect_count": 3
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 21,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 3
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "takimoto3",
"commits": 59,
"avatar_url": "https://avatars.githubusercontent.com/u/744915?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"go.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/13 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 7,
"reason": "9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "35c118e6d49bdf512f64f706e8e5a42414cd56c6",
"ran_at": "2026-07-26T12:36:59Z",
"aggregate_score": 3.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T14:48:53Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-25T14:48:15Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/takimoto3/app-attest",
"host": "github.com",
"name": "app-attest",
"owner": "takimoto3"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"security": 49,
"vitality": 76,
"community": 29,
"governance": 47,
"engineering": 61
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 76,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"commits_last_year": 64,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 8
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "8/52 weeks with commits",
"points": 5.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 8
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "64 commits in the last year",
"points": 16.3,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 64
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7",
"points": 7,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 4,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 94.8
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "4 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 4
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~94.8 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 94.8
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 29,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"forks": 2,
"stars": 5,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "5 stars",
"points": 9.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 5
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 47,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 63,
"inputs": {
"merged_prs": 21,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 3
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "21/24 decided PRs merged",
"points": 33.5,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 21,
"decided": 24
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/13 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"followers": 1,
"owner_type": "User",
"is_verified": null,
"owner_login": "takimoto3",
"public_repos": 10,
"account_age_days": 5574
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of takimoto3",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "takimoto3"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~15 yr old",
"points": 19.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 15
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/takimoto3/app-attest"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "4 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 4
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 61,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 49,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 36,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/13 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7",
"points": 5.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 7 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 7
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 2,
"affected_packages": 2,
"assessed_packages": 7,
"unassessed_packages": 0,
"affected_by_severity": "unknown 2",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 7,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 58,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.925,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "62 of 67 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 62,
"sampled": 67
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "go.mod (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "go.mod"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 67",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 67
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 18821,
"source_files_sampled": 16,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/16 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 16,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-26T12:37:13.104998Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/takimoto3/app-attest.svg",
"full_name": "takimoto3/app-attest",
"license_state": "standard",
"license_spdx": "MIT"
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con takimoto3/app-attest. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
