Public recordModerate
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-23 22:06 UTC
ethanolivertroy / wilma
Wilma - AWS Bedrock Security Configuration Checker
ethanolivertroy/wilma holds a health index of 67 out of 100, placing it in the Moderate band. It scores highest on Vitality (82/100) and lowest on Community & Adoption (39/100). It was last updated 2 days ago. A single contributor accounts for most of its recent work.
67
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
67
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
Ethan TroyPersonal account
220 followers198 public repossince Apr 2020Cursor
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| PyPI | wilma-sec | 1.1.0 | - | 3 | 259 days ago | awsbedrocksecuritygenaiaimlauditcompliancewilma |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
82
Development activity
70Good
How it's scored
| 36/36 | Push recency — last push 2 days ago |
| 7.6/36 | Commit cadence — 11/52 weeks with commits |
| 16.8/18 | Commit volume — 74 commits in the last year |
| 10/10 | OpenSSF Scorecard: Maintained — 11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
Inputs used
| commits_last_year | 74 |
| human_commit_share | 0.865 |
| days_since_last_push | 2 |
| active_weeks_last_year | 11 |
Release discipline
100Excellent
How it's scored
| 27/27 | Ships releases — 2 releases published |
| 36/36 | Release recency — latest release 2 days ago |
| 27/27 | Release cadence — a release every ~3.7 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 2 |
| latest_release_tag | v0.2.2 |
| releases_from_tags | no |
| days_since_latest_release | 2 |
| mean_days_between_releases | 3.7 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
39
Popularity & adoption
5Critical
How it's scored
| 4.9/60 | Stars — 3 stars |
| 0/25 | Forks — 1 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 1 |
| stars | 3 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
77Good
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (GPL-3.0) |
| 18/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 6.3/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | yes |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | yes |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
53
Maintainer resilience (bus factor)
19Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 1.4/22.5 | Commit distribution — top contributor authored 94% of commits |
| 2.7/13.5 | Contributor breadth — 2 contributors |
| 6/10 | OpenSSF Scorecard: Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0.938 |
Issue & PR responsiveness
57Moderate
How it's scored
| 46/46.8 | Issue resolution — 98% of issues closed |
| 11.2/38.3 | PR acceptance — 17/58 decided PRs merged |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/10 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 17 |
| open_issues | 1 |
| closed_issues | 62 |
| issue_closed_ratio | 0.984 |
| closed_unmerged_prs | 41 |
Ownership & stewardship
65Moderate
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 16.9/25 | Owner reach — 220 followers of ethanolivertroy |
| 25/25 | Track record — 198 public repos, account ~6 yr old |
Inputs used
| followers | 220 |
| owner_type | User |
| is_verified | — |
| owner_login | ethanolivertroy |
| public_repos | 198 |
| account_age_days | 2,287 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
83Good
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on pypi |
| 26/35 | Publish recency — latest publish 259 days ago |
| 12/20 | Version history — 3 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | wilma-sec |
| ecosystems | pypi |
| any_deprecated | no |
| min_days_since_publish | 259 |
Engineering Quality
Are baseline engineering and documentation practices in place?
80
Engineering practices
94Excellent
How it's scored
| 24/24 | CI workflows — 4 workflow(s) |
| 24/24 | Tests present |
| 16/16 | Linter config |
| 9.6/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard: CI-Tests — 15 out of 15 merged PRs checked by a CI test -- score normalized to 10 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | yes |
| has_precommit_config | yes |
Documentation
60Moderate
How it's scored
| 30/30 | README |
| 0/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 10/10 | Topics — 5 topics |
| 10/10 | Wiki |
Inputs used
| topics | aws, bedrock, genai, llm, security |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | no |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
81
Security posture
76Good
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — no data |
| 2.5/2.5 | CI-Tests — 15 out of 15 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/10 approved changesets -- score normalized to 0 |
| 1.5/2.5 | Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 7.5/7.5 | Maintained — 11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — no data |
| 2/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 4 |
| 5/5 | SAST — SAST tool is run on all commits |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — no data |
| 7.5/7.5 | Token-Permissions — GitHub workflow tokens follow principle of least privilege |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 7.6 |
Excluded from scoring (no data or not applicable): branch_protection, packaging, signed_releases. Remaining weights renormalized.
Dependency advisories
100Excellent
How it's scored
| 35/35 | Direct dependencies free of known advisories — no direct dependency carries a known advisory |
| 25/25 | Indirect dependencies free of known advisories — no indirect dependency carries a known advisory |
| 0/40 | No advisories left outstanding — no advisory carries a publication date |
Inputs used
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 10 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the pypi:wilma-sec@1.1.0 runtime dependency closure — what installing the published package pulls in — 10 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
65
Agent context & guidance
85Excellent
How it's scored
| 45/45 | Agent instructions — CLAUDE.md |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 57 of 64 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.891 |
| agent_instruction_files | CLAUDE.md |
| agent_instruction_max_bytes | 11,688 |
Verify loop (build / test / typecheck)
55Moderate
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 11/11 | Lint / format config |
| 0/11 | Static type checking |
| 0/10 | Reproducible environment |
| 10/10 | Demonstrated agent practice — 20 of the last 74 commits agent-authored or agent-credited |
| 8/8 | Automated maintenance — 10 of the last 74 commits are automated dependency updates |
| 4/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 4 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | — |
| has_dockerfile | no |
| typed_language | no |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | yes |
| typecheck_configs | — |
| agent_commit_share | 0.27 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0.135 |
Code legibility for models
51Moderate
How it's scored
| 0/45 | Type-checkable code — Python without a type-check config |
| 50.9/55 | Manageable file sizes — 3/40 source files over 60KB |
Inputs used
| primary_language | Python |
| largest_source_bytes | 125,690 |
| source_files_sampled | 40 |
| oversized_source_files | 3 |
Key facts
3GitHub stars
2contributors
74commits, last 12 months
2days since last push
2releases
1bus factor
1open issues
PyPIpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
OpenSSF Scorecard 7.6 / 10
7.6aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| n/a | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 10 | CI-Tests | 15 out of 15 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/10 approved changesets -- score normalized to 0 |
| 6 | Contributors | project has 2 contributing companies or organizations -- score normalized to 6 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| n/a | Packaging | packaging workflow not detected |
| 4 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 4 |
| 10 | SAST | SAST tool is run on all commits |
| 10 | Security-Policy | security policy file detected |
| n/a | Signed-Releases | no releases found |
| 10 | Token-Permissions | GitHub workflow tokens follow principle of least privilege |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
Direct dependencies 4
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| PyPI | boto3 | >=1.43.51,<2.0.0 | pyproject.toml |
| PyPI | botocore | >=1.43.51,<2.0.0 | pyproject.toml |
| PyPI | rich | >=15.0.0,<16.0.0 | pyproject.toml |
| PyPI | pyyaml | >=6.0.3,<7.0.0 | pyproject.toml |
All dependencies 19
Full resolved dependency set from the GitHub dependency graph: 4 direct and 15 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
| Registry | Package | Version | Relation |
|---|---|---|---|
| PyPI | boto3 | — | direct |
| PyPI | botocore | — | direct |
| PyPI | pyyaml | — | direct |
| PyPI | rich | — | direct |
| PyPI | bandit | — | indirect |
| PyPI | boto3-stubs | — | indirect |
| PyPI | build | — | indirect |
| PyPI | ipython | — | indirect |
| PyPI | moto | — | indirect |
| PyPI | mypy | — | indirect |
| PyPI | pre-commit | — | indirect |
| PyPI | pytest | — | indirect |
| PyPI | pytest-cov | — | indirect |
| PyPI | pytest-mock | — | indirect |
| PyPI | pytest-xdist | — | indirect |
| PyPI | ruff | — | indirect |
| PyPI | setuptools | — | indirect |
| PyPI | twine | — | indirect |
| PyPI | types-pyyaml | — | indirect |
Dependency advisories 0
Installing pypi:wilma-sec@1.1.0 pulls in 10 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"aws",
"bedrock",
"genai",
"llm",
"security"
],
"is_fork": false,
"size_kb": 979,
"has_wiki": true,
"homepage": null,
"languages": {
"Python": 738656
},
"pushed_at": "2026-07-21T17:33:11Z",
"created_at": "2025-05-29T18:01:07Z",
"owner_type": "User",
"updated_at": "2026-07-21T13:30:57Z",
"description": "Wilma - AWS Bedrock Security Configuration Checker",
"is_archived": false,
"is_disabled": false,
"license_spdx": "GPL-3.0",
"default_branch": "main",
"license_spdx_raw": "GPL-3.0",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": "https://ethantroy.dev",
"name": "Ethan Troy",
"type": "User",
"login": "ethanolivertroy",
"company": "Cursor",
"location": "Florida",
"followers": 220,
"avatar_url": "https://avatars.githubusercontent.com/u/63926014?v=4",
"created_at": "2020-04-18T18:35:36Z",
"is_verified": null,
"public_repos": 198,
"account_age_days": 2287
},
"license": {
"state": "standard",
"spdx_id": "GPL-3.0",
"raw_spdx": "GPL-3.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2026-07-21T13:29:59Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-07-17T21:08:28Z"
}
],
"recent_commits": [
{
"oid": "7cfc9e8591ef3bd31706f9666c4ded14d26f0c2d",
"body": "….2.2 (#121)\n\n* Drop Python 3.9 support and apply deferred dependency updates\n\n- requires-python >=3.10, remove 3.9 classifier, CI matrix, docs\n- boto3/botocore >=1.43.51, pytest >=9.1.1, moto >=5.2.2,\n types-PyYAML >=6.0.12.20260518, build >=1.5.0\n- ruff target-version py310, mypy python_version 3\n[…]\norted kwargs\n\nWilmaConfig.__init__ only accepts config_path; the fixture passed\nregion/checks_enabled/min_risk_level kwargs that would raise TypeError\nif any test used it. Flagged by CodeQL on PR 121.",
"is_bot": false,
"headline": "Drop Python 3.9 support, apply deferred dependency updates, release 0…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-07-21T13:27:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ea5ba7b443e126b34a2a313846b35bbb52d749be",
"body": "…, #116, #119) (#120)\n\n* Apply outstanding Dependabot dependency updates (#105-#112, #114, #116-#119)\n\n* Exclude moto 5.2.x bump (requires Python >=3.10)\n\n* Exclude types-PyYAML 2026 stubs bump (requires Python >=3.10)\n\n* Exclude build 1.5.0 bump (requires Python >=3.10)",
"is_bot": false,
"headline": "Consolidate Dependabot dependency updates (#105-#107, #110-#112, #114…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-07-21T12:48:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f424f8b7840b5a31b530c6781fefbfc7b1d359c",
"body": null,
"is_bot": false,
"headline": "Fix OpenSearch policy assessment regressions (#104)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-07-18T00:16:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4eb270a854c895aea815eae510d63fb5d81d158a",
"body": "* Fix thermo-nuclear code quality review findings\n\nBlockers:\n- Replace phantom bedrock-agent policy getters (get_collection_security_policy,\n get_data_access_policy) with real opensearchserverless list/get policy APIs.\n The old duck-typed getattr calls only executed under test mocks and were\n sil\n[…]\nS network and data-access check failures so an API error on\n one policy type no longer skips the other check.\n- Add regression tests for null/missing Action+Resource and None AOSS\n policy documents.",
"is_bot": false,
"headline": "Fix thermo-nuclear code quality review findings (#103)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-07-18T00:01:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ab6d46f8ac5b7489ce67308ae15cbd4ab92057e9",
"body": "…date-50c7\n\nConsolidate outstanding PRs: modernized Bedrock checks, dependency updates, 0.2.1 release",
"is_bot": false,
"headline": "Merge pull request #102 from ethanolivertroy/cursor/project-health-up…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-07-17T21:05:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5e9e9f4e73bbe280b82254d98ce301337dc791e",
"body": "Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>",
"is_bot": false,
"headline": "Bump version to 0.2.1 and add changelog entry",
"author_name": "Cursor Agent",
"author_login": "cursoragent",
"committed_at": "2026-07-17T19:44:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d6b97c3516755ad7a88e62ed4f0097b6303b1878",
"body": "Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>",
"is_bot": false,
"headline": "Apply outstanding Dependabot dependency updates (#90-#100)",
"author_name": "Cursor Agent",
"author_login": "cursoragent",
"committed_at": "2026-07-17T19:44:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bc255a0a748f3a110996782abd31f82a3402e5c",
"body": "Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>",
"is_bot": false,
"headline": "Add report coverage and lint adjustments",
"author_name": "Cursor Agent",
"author_login": "cursoragent",
"committed_at": "2026-06-28T02:45:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f6aa24008f4b7f94b9534a0060362401ca26a2a",
"body": "Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com>",
"is_bot": false,
"headline": "Modernize Bedrock checks and library API",
"author_name": "Cursor Agent",
"author_login": "cursoragent",
"committed_at": "2026-06-28T02:41:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "adec1d224f7e5bce79b7144288eed380adb61d9a",
"body": null,
"is_bot": false,
"headline": "Apply Dependabot dependency updates",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-05-11T04:21:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc5d1c0e249c3b7d09afe02811a162a5d9923346",
"body": null,
"is_bot": false,
"headline": "Reboot Wilma posture assessment beta",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-05-11T04:10:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa86a50eb9f4b1974ce9059d00c793dbc738d5f0",
"body": "…/github/codeql-action-4.32.3\n\nci(deps): bump github/codeql-action from 4.32.2 to 4.32.3",
"is_bot": false,
"headline": "Merge pull request #74 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-02-16T15:50:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53398819884fffdad7664057b67fa4e03c244ac9",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.2 to 4.32.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/4\n[…]\nendency-name: github/codeql-action\n dependency-version: 4.32.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump github/codeql-action from 4.32.2 to 4.32.3",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-16T03:13:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2ab2b75d438947f67f35a1eb397c65b44d726724",
"body": "…/github/codeql-action-4.32.2\n\nci(deps): bump github/codeql-action from 4.32.0 to 4.32.2",
"is_bot": false,
"headline": "Merge pull request #73 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-02-10T06:48:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e6fd0e5406b953a81a9cba534a467edf9ec68a1",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.0 to 4.32.2.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/b\n[…]\nendency-name: github/codeql-action\n dependency-version: 4.32.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump github/codeql-action from 4.32.0 to 4.32.2",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-09T03:14:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b7554f03e861884e041624ab204424e3bec2f8ee",
"body": "…/actions/setup-python-6.2.0\n\nci(deps): bump actions/setup-python from 6.1.0 to 6.2.0",
"is_bot": false,
"headline": "Merge pull request #72 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-28T18:47:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e3023380899b6651f39d0379bce52373a36618f",
"body": "…/github/codeql-action-4.31.11\n\nci(deps): bump github/codeql-action from 4.31.9 to 4.31.11",
"is_bot": false,
"headline": "Merge pull request #71 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-28T18:47:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f1639c902e8dc937e8b98a8ef2fcf60fda9dbfc",
"body": "…/actions/checkout-6.0.2\n\nci(deps): bump actions/checkout from 6.0.1 to 6.0.2",
"is_bot": false,
"headline": "Merge pull request #70 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-28T18:46:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c763402268cd46fdbf65e565827fa9c40952d350",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.9 to 4.31.11.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/\n[…]\nndency-name: github/codeql-action\n dependency-version: 4.31.11\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump github/codeql-action from 4.31.9 to 4.31.11",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-01-28T18:41:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "53974d9e23c3a5f7dc766f9276baf15cb5326934",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/8e8c483db84b4bee98b60c0\n[…]\n- dependency-name: actions/checkout\n dependency-version: 6.0.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/checkout from 6.0.1 to 6.0.2",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-01-28T18:41:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f171d261251224a7ce7f7d78ac8584e720735700",
"body": "Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.1.0 to 6.2.0.\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/83679a892e2d95755f2dac6acb0bfd1e9ac5d548...a309ff8b426b58ec0e2a45f0f869d46889d024\n[…]\npendency-name: actions/setup-python\n dependency-version: 6.2.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/setup-python from 6.1.0 to 6.2.0",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-01-28T18:41:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dd0d14a2cedb4868e9367b8252d655c69cc93339",
"body": "- Add missing methods to check classes to resolve AttributeError issues\n- Fix S3 encryption exception handling for moto compatibility\n- Update test assertions to match actual finding field names\n- Create mock AWS managed policies for IAM tests\n- Change expected risk levels to match implementation",
"is_bot": false,
"headline": "Fix failing tests - add missing check methods and fix test assertions",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-28T17:58:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9585a3cb7ea44ecf6b434af2c362f6111fc1006",
"body": "…/actions/upload-artifact-6.0.0\n\nci(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0",
"is_bot": false,
"headline": "Merge pull request #51 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-16T05:23:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a7021dd4b70eab3856ad6e7a1b7725931cc4b9e",
"body": "…/actions/setup-python-6.1.0\n\nci(deps): bump actions/setup-python from 5.6.0 to 6.1.0",
"is_bot": false,
"headline": "Merge pull request #52 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-16T05:23:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "08819252c0e7ebe6177d8400d4e5a74231c9bd62",
"body": "…/actions/checkout-6.0.1\n\nci(deps): bump actions/checkout from 4.3.1 to 6.0.1",
"is_bot": false,
"headline": "Merge pull request #53 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-16T05:23:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "90b4813a5957c8411c9d421b27831e07a3567143",
"body": "…/github/codeql-action-4.31.9\n\nci(deps): bump github/codeql-action from 3.31.9 to 4.31.9",
"is_bot": false,
"headline": "Merge pull request #54 from ethanolivertroy/dependabot/github_actions…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-16T05:23:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4e23aacf479b9d83b587a40c91b0cc3111603a4",
"body": "…3.7.0-and-lt-15.0.0\n\ndeps(deps): update rich requirement from <14.0.0,>=13.7.0 to >=13.7.0,<15.0.0",
"is_bot": false,
"headline": "Merge pull request #68 from ethanolivertroy/dependabot/pip/rich-gte-1…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2026-01-16T05:23:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cddd8eaf5277b6e98075a6c33ef3c53e5497097c",
"body": "Updates the requirements on [rich](https://github.com/Textualize/rich) to permit the latest version.\n- [Release notes](https://github.com/Textualize/rich/releases)\n- [Changelog](https://github.com/Textualize/rich/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/Textualize/rich/compare/v13.7.0...v14.2.0)\n\n---\nupdated-dependencies:\n- dependency-name: rich\n dependency-version: 14.2.0\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "deps(deps): update rich requirement",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-01-05T03:29:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e5d82e42877fb4d1c1f3de6f15e57644a554f72",
"body": "…0% COMPLETE 🎉\n\nImplemented comprehensive Fine-Tuning security module with all 11 security checks:\n\n**fine_tuning.py** - Complete rewrite (243 → 1,169 lines, +926 insertions):\n1. Training Data Bucket Security (266 lines) - Public access, encryption, versioning\n2. Training Data PII Detection (107 lin\n[…]\nnged: 5\nInsertions: ~1,000 lines\nModule: Fine-Tuning Security (100% complete)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement AWS Bedrock Fine-Tuning Security Module - PRIORITY 1 NOW 10…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-31T09:33:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4bec7a4c4ffd13708793b0dc27f4f236125bf451",
"body": "Added comprehensive entry for AWS Bedrock Knowledge Bases (RAG) Security Module:\n- All 12 security checks documented\n- OWASP LLM01, LLM03, LLM06, LLM07 coverage\n- MITRE ATLAS AML.T0020 (Poison Training Data) coverage\n- Compliance: HIPAA, PCI-DSS, SOC 2, ISO 27001, GDPR Art. 32\n- 2,237 lines of code,\n[…]\nlines, 25 tests (80% passing)\n\nTotal: 33 security checks, 5,271 lines of code\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add Knowledge Bases module to CHANGELOG",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-31T09:02:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "68cd6bdf61509cc096a7f8bf80d3429ab3852e95",
"body": "Updated ROADMAP.md to accurately reflect project status:\n- Knowledge Bases (RAG): Marked as 100% complete (12 of 12 checks)\n- Detailed all 12 implemented security checks with line counts\n- Updated coverage statistics: OWASP 70%, MITRE ATLAS 50%, Bedrock 75%\n- Corrected outdated module completion per\n[…]\necurity checks\n\nTotal: 5,271 lines of security checking code across 33 checks\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Document Knowledge Bases module completion and fix test structure",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-31T09:01:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f1d3f36fc8cf431ec1f7911b324c5a6dc456b612",
"body": "Added comprehensive documentation for AWS Bedrock Guardrails Security Module\nacross all three documentation files:\n\n**README.md:**\n- Added \"Guardrails Security\" section with all 11 security checks\n- Highlighted key features: strength configuration, automated reasoning,\n PROMPT_ATTACK filter, PII fi\n[…]\nes documenting 11 security checks\nModule: Guardrails Security (100% complete)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Update documentation for Guardrails module completion",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-31T08:01:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a4bba66404785309dfe4f901531eca45f61f66a3",
"body": "Added both critical security modules to BedrockSecurityChecker:\n\n**Agents Module (10 checks):**\n- Action confirmation validation\n- Guardrail enforcement\n- Service role permissions\n- Lambda function security\n- Knowledge base access\n- Memory encryption\n- Resource tagging\n- PII detection\n- Prompt injec\n[…]\nun_all_checks() method\n- ✅ Updated class docstring with OWASP mappings\n- ✅ Prioritized critical checks first (Agents, Guardrails, KB)\n\nAll 33 checks (10 Agents + 11 Guardrails + 12 KB) now integrated!",
"is_bot": false,
"headline": "Integrate Agents and Guardrails modules into main security checker",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T23:33:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5ce813d60b30886dfe92385344a1a72a30aa2186",
"body": "Completed implementation of all 11 Guardrails security checks:\n1. ✅ Strength Configuration - Validates HIGH filter strength (not LOW/MEDIUM)\n2. ✅ Automated Reasoning - Checks hallucination prevention (NEW 2025 feature)\n3. ✅ Content Filter Coverage - Validates all threat categories including PROMPT_A\n[…]\nhandling\n- Detailed findings with remediation steps\n- OWASP category mappings throughout\n- \"WHY CRITICAL\" explanations in all docstrings\n\nNext: Integration into main checker, test suite, documentation",
"is_bot": false,
"headline": "Implement AWS Bedrock Guardrails Security Module (11 of 11 checks)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T23:01:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e93aeeea6bc0098e43f491c21c2d26283f4fda02",
"body": "Resolved test failures caused by outdated method names:\n- check_data_source_encryption() → check_s3_bucket_encryption()\n- check_chunking_configuration() → check_knowledge_base_chunking_config()\n- check_iam_permissions() → check_knowledge_base_access_patterns()\n- check_pii_exposure() → check_pii_in_e\n[…]\nsults:\n- Before: 14/25 passing (56%)\n- After: 19/25 passing (76%)\n- Remaining 6 failures are test setup issues, not implementation bugs\n\nAll 12 KB security checks are fully implemented and functional.",
"is_bot": false,
"headline": "Fix Knowledge Bases test suite method name mismatches",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T21:33:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1d10c49f46413d83e3941a5b7550294c8275190c",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.31.9 to 4.31.9.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/4\n[…]\nendency-name: github/codeql-action\n dependency-version: 4.31.9\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump github/codeql-action from 3.31.9 to 4.31.9",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2025-12-30T21:11:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0fb21bae6735566d053efc22a0f18660b9abb873",
"body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...b7c566a772e6b6bfb58ed0dc25\n[…]\ndency-name: actions/upload-artifact\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2025-12-30T21:10:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d4f4bc9b394d15d398b4686d31d695ad4be05178",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.1.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a5638\n[…]\n- dependency-name: actions/checkout\n dependency-version: 6.0.1\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/checkout from 4.3.1 to 6.0.1",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2025-12-30T21:10:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "53811b2ff6f0a77fc4cc21a6f523897b0bb6594b",
"body": "Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...83679a892e2d95755f2dac6acb0bfd1e9ac5d5\n[…]\npendency-name: actions/setup-python\n dependency-version: 6.1.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/setup-python from 5.6.0 to 6.1.0",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2025-12-30T21:10:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "84523dc64658a585196180220d7a5d8065f7b9b3",
"body": "- Updated README.md with Agents Security section (10 checks)\n- Updated CHANGELOG.md with full feature list and compliance mappings\n- Updated ROADMAP.md to show 100% completion with detailed statistics\n- Closed all GitHub issues: #4, #29-#38\n\nDocumentation changes reflect:\n- 1,838 lines of production\n[…]\nAMP, SOC 2, ISO 27001, GDPR\n- Addresses #1 attack vector for 2025 per ROADMAP\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Update documentation for Agents module completion",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T19:53:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4eefd04fa7964aded360bdd9aa8738e328891f58",
"body": "- Implemented check_agent_memory_encryption() (Issue #33, Risk 7/10)\n * Validates memory configuration and encryption\n * Flags agents with memory enabled for manual KMS verification\n * Compliance: HIPAA, PCI-DSS, FedRAMP\n\n- Implemented check_agent_tags() (Issue #35, Risk 5/10)\n * Validates prese\n[…]\ntation: 1,838 lines\n\nPhase 3 complete! All agent security checks implemented.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement final 4 agent security checks (Issues #33, #35, #36, #38)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T19:44:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "889985807a1f28db47f4ab94141ec8603b4ff2c4",
"body": "- Added check_agent_knowledge_base_access() to validate KB security\n- Implemented security checks:\n * Cross-account knowledge base access (MEDIUM finding)\n * Missing/non-existent KB references (MEDIUM finding)\n * Same-account KB access (good practice, no finding)\n- Added 5 comprehensive test case\n[…]\nEDIUM)\nOWASP: LLM08 (Excessive Agency)\nLines: +185 implementation, +180 tests\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement agent KB access check (Issue #34)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T18:56:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a4d28cb0152933001e4a8e9901e4b7ba0bc8e702",
"body": "- Added check_agent_lambda_permissions() to validate Lambda security\n- Added helper method _analyze_lambda_security() for detailed analysis\n- Added Lambda client initialization in AgentSecurityChecks.__init__()\n- Implemented security checks:\n * Public Lambda invocation access (CRITICAL finding)\n *\n[…]\n(HIGH)\nOWASP: LLM08 (Excessive Agency)\nLines: +425 implementation, +320 tests\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement agent Lambda permissions check (Issue #32)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T18:17:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "31148cdb92275a1ef47a7775126198322fcb1983",
"body": "Implement the fourth HIGH-priority security check for AWS Bedrock Agents:\ncheck_agent_service_roles() validates agent service role IAM permissions\nfollow least privilege principles.\n\nWHY CRITICAL: Agents with overly permissive service roles (e.g.,\nAdministratorAccess) can access AWS resources beyond\n[…]\nn + tests)\n\nAgents Module Progress: 40% complete (4 of 10 checks implemented)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement agent service roles check (Issue #31)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T16:51:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d0ecb26c27dc01421840f6cc182fac902399662f",
"body": "Implement the third HIGH-priority security check for AWS Bedrock Agents:\ncheck_agent_prompt_injection_patterns() scans agent instructions for\nknown prompt injection vulnerabilities and missing security guidance.\n\nWHY CRITICAL: Agent instructions containing vulnerable patterns or\nlacking security bou\n[…]\n% complete (3 of 10 checks implemented)\nPhase 1 (Critical checks): COMPLETE ✅\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement agent prompt injection patterns check (Issue #37)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T14:49:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73d470d31a54795055acdec2ddfb1a27e77a72d9",
"body": "Implement the second CRITICAL security check for AWS Bedrock Agents module:\ncheck_agent_guardrails() validates that agents have guardrails configured\nto protect against prompt injection attacks.\n\nWHY CRITICAL: 70% of agents in production are deployed without guardrails,\nmaking them vulnerable to ind\n[…]\nn + tests)\n\nAgents Module Progress: 20% complete (2 of 10 checks implemented)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement agent guardrails check (Issue #30)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T14:44:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b4d1d0d0bbe78015dd54ae4acc0c4cb1f34b630d",
"body": "Implement the first CRITICAL security check for AWS Bedrock Agents module:\ncheck_agent_action_confirmation() validates that agents require human\nconfirmation before executing mutating operations.\n\nWHY CRITICAL: 60% of agents in production lack action confirmation,\nallowing autonomous execution of da\n[…]\nn + tests)\n\nAgents Module Progress: 10% complete (1 of 10 checks implemented)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement agent action confirmation check (Issue #29)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-30T14:41:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "68fdac8ae4c83ce9ce58250586ae700c74eb78b2",
"body": "…ve code quality\n\nBREAKING CHANGE: Minimum Python version raised from 3.8 to 3.9\n- Aligns with AWS CloudShell default (Python 3.9.16)\n- Python 3.8 reached EOL October 2024\n\nCritical Fixes:\n- Fix version triple-mismatch: unified to 1.2.0 across __init__.py, setup.py, pyproject.toml\n- Delete requireme\n[…]\nts\n- requirements.txt - DELETED\n\nNet Result: -16 lines (78 added, 94 removed)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Repository cleanup: fix version mismatches, update Python 3.9+, impro…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-29T15:16:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2815c5fe7039ad6b2a66021454a9610a361a4ac0",
"body": "Remove problematic SARIF artifact upload step that used\nrelative pathing '../results/python.sarif' which is not\nallowed by GitHub Actions.\n\nThe codeql-action/analyze already uploads SARIF results\nto GitHub Security tab, so separate artifact upload is\nredundant.\n\nError fixed:\n ##[error]Invalid pattern '../results/python.sarif'.\n Relative pathing '.' and '..' is not allowed.",
"is_bot": false,
"headline": "Fix CodeQL workflow artifact upload path",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T19:33:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3cd21cfac0ee2ba276afe8cccfb99ff6f1595e55",
"body": "Static Application Security Testing:\n- Add CodeQL workflow for automated code scanning\n- Scans Python code for security vulnerabilities\n- Runs on push, pull requests, weekly schedule, and manual trigger\n\nConfiguration:\n- Language: Python\n- Queries: security-extended + security-and-quality\n- Schedule\n[…]\nact:\n- SAST: 0/10 → 10/10 (+10 points)\n- Overall OSSF Score: 6.4/10 → ~6.9/10\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add CodeQL security analysis workflow (SAST)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T13:47:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aa5cefd3ddca016735182d0fded5f3b6aee41886",
"body": "Security Policy:\n- Add SECURITY.md with comprehensive vulnerability reporting process\n- Document security best practices for AWS credential handling\n- List known limitations and security tooling\n- Establish coordinated disclosure timeline\n\nDependency Management:\n- Add Dependabot configuration for au\n[…]\nection (requires repo admin)\n- Code review enforcement (requires PR workflow)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Implement OSSF Scorecard security improvements (4/10 → 7+/10)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T12:53:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "76d5b12c07cb71c543d50dc8741e63027bd9de51",
"body": "Workflow Fixes:\n- Remove non-existent develop branch from test.yml and publish.yml\n- Update mypy comments to clarify intentional continue-on-error behavior\n- Update coverage comments to match PR template requirements (50%)\n- Add tomli fallback comment in publish.yml version check\n- Add tomli to pypr\n[…]\nekly security health checks\n- README.md: Added OSSF Scorecard badge (line 10)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix GitHub workflows and add OSSF Scorecard security assessment",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T04:11:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f7d29e22a4f14cc03dcc8cd4815aca862638bf5d",
"body": "Removed:\n- ISSUE_STATUS.md - Moved tracking to GitHub Issues\n- GITHUB_ISSUES_ARCHIVED.md - Archived and obsolete\n- IMPROVEMENTS.md - Preparing for project reset\n\nRationale:\n- GitHub Issues provides better tracking for active work\n- Completed work already documented in CHANGELOG.md\n- Reduces redundant tracking files in repository\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Clean up obsolete markdown tracking files",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T03:01:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a3f69369edfc2f03ec952fae5d5da89757eca118",
"body": "ENHANCEMENT: Added comprehensive IAM policy analysis to embedding model\naccess control check. Now detects overly permissive IAM policies on\nKnowledge Base execution roles.\n\nImplementation Changes:\n- Added _analyze_iam_policies_for_embedding_model() method (lines 2055-2204)\n * Analyzes attached mana\n[…]\n checks\n- Provides actionable remediation guidance with specific ARNs\n- No breaking changes - additive enhancement only\n\nRelated commits:\n- 5453fdd: Add comprehensive unit tests for KB security checks",
"is_bot": false,
"headline": "Enhance embedding model check with deep IAM policy analysis",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T01:57:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5453fddca238d4fba3ab80bf629dc6ace4eed21d",
"body": "Added 9 unit tests covering the 3 remaining Knowledge Bases checks:\n\nS3 Public Access Tests (3 tests):\n- test_s3_bucket_fully_blocked: Validates buckets with all 4 BPA settings\n- test_s3_bucket_partially_blocked: Detects missing BPA settings\n- test_s3_bucket_no_bpa_config: Handles buckets without BP\n[…]\nlly overriding kb_checks.bedrock_agent with mocked client\n- Moto exception handling limitation documented in test_s3_bucket_no_bpa_config\n\nRelated: ISSUE_STATUS.md update (KB module now 100% complete)",
"is_bot": false,
"headline": "Add comprehensive unit tests for KB security checks",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T01:43:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0cf66e1fa4c13e8080b4853dd99d3cb0914d14e5",
"body": "CRITICAL DISCOVERY: The 3 'missing' Knowledge Bases checks were already\nfully implemented! This was a documentation issue, not a code issue.\n\nChanges:\n- README.md: Use local wilma-logo.jpg instead of GitHub assets URL\n- ISSUE_STATUS.md: Update KB module completion from 67% to 100%\n- Move checks #10-\n[…]\n2053) - COMPLETE (basic)\n\nNext: Add comprehensive unit tests for all 3 checks\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Update docs: KB module is 100% complete, fix README image",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T00:59:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "834ca1d63356119e24a9476467f93d03099710d8",
"body": null,
"is_bot": false,
"headline": "Add Rich UI demo script - showcase beautiful terminal output",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T00:42:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b84bcc81652c0fd0f77ce6069892a603a75135c8",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG for v1.2.0 - Rich UI and Wiki",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T00:33:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4ad8e0ce7d3add267cdb3dd18a936f792f7d596",
"body": "Replaced colorama + tabulate with rich for Charmbracelet-quality output:\n- Beautiful tables with borders and colors\n- Summary panels with proper formatting\n- Risk-based color coding (red/yellow/blue)\n- Blinking critical alerts\n- Clean grid layouts for info\n- Enhanced learning mode with styled tables\n[…]\nes both)\n\nVersion bump: 1.1.0 → 1.2.0\n\nThe terminal output is now gorgeous! 🎨\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add rich library for beautiful terminal UI (v1.2.0)",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T00:32:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "455eff73b8a734b5718faaf76cab8691d3550831",
"body": "Created wiki pages teaching AWS Bedrock security threats:\n- Home: Overview and navigation\n- GenAI Security Fundamentals: 7 pillars of GenAI security\n- OWASP LLM Top 10: Industry standard threat taxonomy\n- Knowledge Bases (RAG) Security: Deep dive into 12 security checks\n- Installation Guide: Get sta\n[…]\nx.\nEach page includes real-world examples, attack scenarios, and remediation.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add comprehensive educational wiki content for GenAI security",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-12-28T00:15:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0ea7a64b8da0b763485bb1133b3cfc5e32c1f926",
"body": "- Rewrote ALL 41 remaining tests to use hybrid approach\n- test_logging_checks.py: 11 tests - S3 buckets and CloudWatch logs with Moto\n- test_kb_checks.py: 10 tests - Knowledge bases with Bedrock Agent mocks + S3/IAM via Moto\n- test_network_checks.py: 8 tests - VPC endpoints and security groups with \n[…]\ning checks\n\nTotal tests rewritten: 49 (8 GenAI/IAM + 41 remaining)\nAll tests now use real AWS resource creation via Moto where supported\nBedrock operations use MagicMock due to incomplete Moto support",
"is_bot": false,
"headline": "Complete test suite rewrite with Moto + MagicMock hybrid approach",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T17:53:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a40264b2fce087d0510598141b4e5ba430b28f50",
"body": "- Rewrite GenAI tests to create real S3/CloudWatch resources\n- Rewrite IAM tests to create real IAM policies and roles\n- Remove patching in favor of Moto integration testing\n- All 10 tests now use hybrid Moto + MagicMock approach",
"is_bot": false,
"headline": "Fix GenAI and IAM tests to use Moto properly",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T17:14:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c10cead07741f3c70895ca5af76007fd82c1b90",
"body": "- Rewrite conftest.py to use MagicMock for Bedrock (incomplete Moto support)\n- Keep Moto for S3, IAM, EC2, CloudWatch (fully supported)\n- Add helper functions for common Bedrock mock setups\n- Skip unsupported Bedrock contract tests\n- Lower coverage threshold to 50% temporarily\n- Fix linting issues in test files",
"is_bot": false,
"headline": "Implement hybrid Moto + MagicMock testing approach",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T16:52:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb6f1c9cd10c8e41bfc69b273e68f5dae61b4903",
"body": "- Add explicit skip codes (-s flag) to Bandit commands\n- Skip B101, B106, B107, B112, B601 (false positives)",
"is_bot": false,
"headline": "Fix Bandit configuration in CI/CD workflows",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T15:35:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "754e4c1f7f19d9a620ca0802c70d22cff6bb2783",
"body": "- Sort imports alphabetically in tests/helpers.py\n- Remove redundant scope='function' from pytest fixtures\n- Break down compound assertion per PT018",
"is_bot": false,
"headline": "Fix ruff linting violations in test files",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T14:36:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b883b562be48899af8c86b975ec737be5000ece0",
"body": "- Fix Bandit false positives blocking workflows\n- Migrate from MagicMock to Moto for realistic AWS mocking\n- Reorganize tests into unit/integration/contract structure\n- Add test helpers and contract tests for AWS APIs\n- Update CI/CD workflows with proper test configuration",
"is_bot": false,
"headline": "Overhaul testing infrastructure with Moto and fix CI/CD",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T10:20:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "471084933ed99b09663630612c754bd8c3a19090",
"body": "- Updated ruff configuration to be more pragmatic (120 char limit, ignore false positives)\n- Auto-fixed import sorting and unused imports across codebase\n- Added inline comments explaining security false positives (S106/S107 for AWS pagination tokens)\n- Added pre-commit hooks for automated code qual\n[…]\nrotection\n- GitHub release creation integrated into publish workflow\n- Pre-commit package added to requirements-dev.txt\n\nThis resolves all CI/CD test failures and enables automated release management.",
"is_bot": false,
"headline": "Fix CI/CD: Resolve ruff linting violations and add automation",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T04:07:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2a20b10fe432f12f567d6b6bb0d947f888d0c9c4",
"body": "- Published to PyPI as wilma-sec package\n- Implemented GitHub Actions workflows for automated testing and publishing\n- Added 2,114 lines of tests across 7 modules with 80% coverage requirement\n- Integrated security scanning (bandit), linting (ruff), and type checking (mypy)\n- Created comprehensive t\n[…]\n1.1.0 release\n- Added CI/CD status badges to README\n- Created PR template for consistent contributions\n- Cleaned up MANIFEST.in for leaner package distribution\n- Archived historical planning documents",
"is_bot": false,
"headline": "Release v1.1.0: Add CI/CD automation and comprehensive test suite",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-06T03:36:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d1699fc74631e00b94af2a012bf481b5962e54f7",
"body": "Enhanced comments and docstrings across all modules:\n\nCore modules:\n- checker.py: Added architecture overview, detailed method docs\n- reports.py: Clarified output format structure and usage\n\nSecurity check modules:\n- knowledge_bases.py: Comprehensive 12-check overview with threat mapping\n- genai.py:\n[…]\nelopers\n- Removed redundant comments, kept essential security context\n\nGoal: Help developers and AI assistants understand code purpose,\nsecurity rationale, and extension points for future development.",
"is_bot": false,
"headline": "Improve code documentation for v1.0",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-05T23:24:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1c2443f88adea37f0747e575b017a1ddae32525e",
"body": "Previously only 6 checks were documented in learn mode.\nNow includes all 19 checks:\n- 3 GenAI checks (prompt injection, PII, cost)\n- 4 traditional checks (IAM, logging, network, tagging)\n- 12 Knowledge Base checks (S3, vector stores, PII, chunking, etc.)\n\nEach check has clear description, relatable example, and explains why it matters.\nKeeps Wilma's practical, sensible tone throughout.",
"is_bot": false,
"headline": "Expand learn mode to cover all 19 security checks",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-05T22:21:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0c7c6cc8148fb6b2bc52a75aaa8e006c6129c30c",
"body": "Changes:\n- Added ASCII art WILMA banner that displays at scan startup\n- Added decorative ASCII report header and section dividers (◆ ◇ ◆)\n- Updated messages with Wilma's practical, sensible personality\n- Changed headers to emphasize \"Wilma\" branding over generic AWS text\n- Added personality to succe\n[…]\nices are properly configured\"\n- \"There! That wasn't so hard, was it?\"\n\nThis enhances brand recognition and user experience while maintaining\nprofessional functionality and clear technical information.",
"is_bot": false,
"headline": "Add Flintstones-themed branding with ASCII art and Wilma personality",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-05T21:34:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5035f229ecb9ac632240671e06f2e5493223c97",
"body": "Changes:\n- Removed BEGINNER and EXPERT modes, keeping only STANDARD and LEARN\n- STANDARD mode now shows both simple explanations and technical details\n- Removed --expert CLI flag\n- Updated all check modules to always show warnings and technical details\n- Fixed IAM client reference bug in knowledge_b\n[…]\nexpert mode was more thorough. The new STANDARD mode\nprovides comprehensive information to all users, combining the best of both\nprevious modes while maintaining the valuable LEARN mode for education.",
"is_bot": false,
"headline": "Simplify security modes by removing beginner/expert distinction",
"author_name": "ethanolivertroy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-05T20:44:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "660003d4d4ca116737312bc35ea5f58e60421e5c",
"body": "- Add IAM policy creation with bedrock:* wildcard (tests IAM checks)\n- Add unencrypted log bucket creation (tests GenAI checks)\n- Expand Knowledge Base creation to full OpenSearch Serverless setup\n- Add comprehensive security issue summary in output\n- Update cleanup to remove all new resources (IAM \n[…]\nwledge Base security checks ✓\n- 2 IAM security checks ✓\n- 2 Logging checks ✓\n- 1 Network check ✓\n- 3 GenAI checks ✓\n- 1 Tagging check ✓\n\nTotal: 21/21 implemented checks verified working (95% coverage)",
"is_bot": false,
"headline": "Enhance demo script to test all 21 Wilma security checks",
"author_name": "ethanolivertroy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-05T19:21:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c0afcdfe09fc6201aab679d0a356789849fdaed1",
"body": "…cker\n\nComplete security auditing tool for AWS Bedrock with focus on:\n- Knowledge Base (RAG) security (12 checks)\n- IAM and access control\n- Encryption and data protection\n- GenAI-specific vulnerabilities (prompt injection, PII detection)\n- Logging and monitoring\n- Network security\n- Resource tagging compliance\n\nIncludes demo setup script for testing with intentionally insecure resources.",
"is_bot": false,
"headline": "Initial commit: Wilma v1.0.0 - AWS Bedrock security configuration che…",
"author_name": "Ethan Troy",
"author_login": "ethanolivertroy",
"committed_at": "2025-11-05T15:52:50Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 74,
"latest_release_at": "2026-07-21T13:29:59Z",
"latest_release_tag": "v0.2.2",
"releases_from_tags": false,
"days_since_last_push": 2,
"active_weeks_last_year": 11,
"days_since_latest_release": 2,
"mean_days_between_releases": 3.7
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 85,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "wilma-sec",
"exists": true,
"license": "GPL-3.0-or-later",
"keywords": [
"aws",
"bedrock",
"security",
"genai",
"ai",
"ml",
"audit",
"compliance",
"wilma",
"Development Status :: 4 - Beta",
"Intended Audience :: Developers",
"Intended Audience :: System Administrators",
"License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
"Operating System :: OS Independent",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.10",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.8",
"Programming Language :: Python :: 3.9",
"Topic :: Security",
"Topic :: System :: Systems Administration"
],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/wilma-sec/",
"is_deprecated": false,
"latest_version": "1.1.0",
"repository_url": "https://github.com/ethanolivertroy/wilma",
"versions_count": 3,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": "2025-11-06T02:07:09.918746Z",
"latest_published_at": "2025-11-06T02:07:11.014252Z",
"latest_version_yanked": null,
"days_since_latest_publish": 259
}
]
},
"popularity": {
"forks": 1,
"stars": 3,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-04-15",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 125690,
"source_files_sampled": 40,
"oversized_source_files": 3,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 11688
},
"dependencies": {
"manifests": [
"pyproject.toml",
"requirements-dev.txt",
"setup.py"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 10,
"malicious_count": 0,
"assessed_package": "pypi:wilma-sec@1.1.0",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"pypi"
],
"dependencies": [
{
"name": "boto3",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=1.43.51,<2.0.0"
},
{
"name": "botocore",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=1.43.51,<2.0.0"
},
{
"name": "rich",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=15.0.0,<16.0.0"
},
{
"name": "pyyaml",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=6.0.3,<7.0.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "boto3",
"direct": true,
"version": null,
"ecosystem": "pypi"
},
{
"name": "botocore",
"direct": true,
"version": null,
"ecosystem": "pypi"
},
{
"name": "pyyaml",
"direct": true,
"version": null,
"ecosystem": "pypi"
},
{
"name": "rich",
"direct": true,
"version": null,
"ecosystem": "pypi"
},
{
"name": "bandit",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "boto3-stubs",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "build",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "ipython",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "moto",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "mypy",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "pre-commit",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "pytest",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "pytest-cov",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "pytest-mock",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "pytest-xdist",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "ruff",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "setuptools",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "twine",
"direct": false,
"version": null,
"ecosystem": "pypi"
},
{
"name": "types-pyyaml",
"direct": false,
"version": null,
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 19,
"direct_count": 4,
"indirect_count": 15
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 17,
"open_issues": 1,
"closed_ratio": 0.984,
"closed_issues": 62,
"closed_unmerged_prs": 41
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "ethanolivertroy",
"commits": 60,
"avatar_url": "https://avatars.githubusercontent.com/u/63926014?v=4"
},
{
"type": "User",
"login": "cursoragent",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/199161495?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.938
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"codeql.yml",
"publish.yml",
"scorecard.yml",
"test.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": true
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "15 out of 15 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/10 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 4,
"reason": "dependency not pinned by hash detected -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "7cfc9e8591ef3bd31706f9666c4ded14d26f0c2d",
"ran_at": "2026-07-23T22:05:46Z",
"aggregate_score": 7.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": true,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T13:28:26Z",
"oldest_open_prs": [
{
"number": 122,
"created_at": "2026-07-21T17:18:16Z",
"last_comment_at": "2026-07-21T17:18:39Z",
"last_comment_author": "coderabbitai"
}
],
"last_merged_pr_at": "2026-07-21T13:27:35Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 83,
"created_at": "2026-04-15T16:13:43Z",
"last_comment_at": "2026-05-11T04:51:13Z",
"last_comment_author": "ethanolivertroy"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/ethanolivertroy/wilma",
"host": "github.com",
"name": "wilma",
"owner": "ethanolivertroy"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"security": 81,
"vitality": 82,
"community": 39,
"governance": 53,
"engineering": 80
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 82,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"commits_last_year": 74,
"human_commit_share": 0.865,
"days_since_last_push": 2,
"active_weeks_last_year": 11
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "11/52 weeks with commits",
"points": 7.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 11
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "74 commits in the last year",
"points": 16.8,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 74
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v0.2.2",
"releases_from_tags": false,
"days_since_latest_release": 2,
"mean_days_between_releases": 3.7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.7 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 2,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 2 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 2
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 39,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 5,
"inputs": {
"forks": 1,
"stars": 3,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "3 stars",
"points": 4.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 3
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (GPL-3.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "GPL-3.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 53,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 19,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.938
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 94% of commits",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 94
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"merged_prs": 17,
"open_issues": 1,
"closed_issues": 62,
"issue_closed_ratio": 0.984,
"closed_unmerged_prs": 41
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "98% of issues closed",
"points": 46,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 98
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "17/58 decided PRs merged",
"points": 11.2,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 17,
"decided": 58
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/10 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 65,
"inputs": {
"followers": 220,
"owner_type": "User",
"is_verified": null,
"owner_login": "ethanolivertroy",
"public_repos": 198,
"account_age_days": 2287
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "220 followers of ethanolivertroy",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 220,
"login": "ethanolivertroy"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "198 public repos, account ~6 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 198
}
},
{
"code": "account_age_years",
"params": {
"years": 6
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "good",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 83,
"inputs": {
"packages": [
"wilma-sec"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 259
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 259 days ago",
"points": 26,
"status": "partial",
"details": [
{
"code": "publish_recency",
"params": {
"days": 259
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "3 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 3
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 80,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 94,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": true
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 16,
"status": "met",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 9.6,
"status": "met",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "15 out of 15 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"topics": [
"aws",
"bedrock",
"genai",
"llm",
"security"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "good",
"name": "Security",
"value": 81,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "good",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 76,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 7.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "15 out of 15 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/10 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "11 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 4",
"points": 2,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the pypi:wilma-sec@1.1.0 runtime dependency closure — what installing the published package pulls in — 10 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "pypi:wilma-sec@1.1.0",
"assessed": 10
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 10,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 10,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 65,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.891,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 11688
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "57 of 64 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 57,
"sampled": 64
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.27,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0.135
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 11,
"status": "met",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "20 of the last 74 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 20,
"sampled": 74
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "10 of the last 74 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 10,
"sampled": 74
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 4",
"points": 4,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 125690,
"source_files_sampled": 40,
"oversized_source_files": 3
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "3/40 source files over 60KB",
"points": 50.9,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 40,
"oversized": 3
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-23T22:06:01.563839Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/e/ethanolivertroy/wilma.svg",
"full_name": "ethanolivertroy/wilma",
"license_state": "standard",
"license_spdx": "GPL-3.0"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — PyPI.