valiss-dev / valiss-go

Повний розв'язаний набір залежностей із графа залежностей GitHub: 7 прямих і 35 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.

Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 42 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 3 мають відомі сповіщення, з них 1 прямі.

Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 350,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 352218
      },
      "pushed_at": "2026-07-22T10:55:18Z",
      "created_at": "2026-07-09T09:21:46Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-22T10:55:25Z",
      "description": null,
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://valiss.dev",
      "name": "valiss",
      "type": "Organization",
      "login": "valiss-dev",
      "company": null,
      "location": null,
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/304555778?v=4",
      "created_at": "2026-07-13T16:36:08Z",
      "is_verified": null,
      "public_repos": 9,
      "account_age_days": 9
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2026-07-17T11:36:35Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-07-16T16:16:21Z"
        },
        {
          "tag": "v0.13.0-rc.1",
          "kind": "prerelease",
          "published_at": "2026-07-16T15:12:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "bee2637d4d1922e7f5a6f6dd4bdd15feb47c729c",
          "body": "Entity generation-floor extension and enforcement (ADR 0022)",
          "is_bot": false,
          "headline": "Merge pull request #20 from valiss-dev/feat/generation-floor",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-22T10:55:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "483ec646e6d87f14c5927d79d762200ea602fa26",
          "body": "Standard GitHub Security policy: pre-1.0 supported-version caveat, private reporting via GitHub Security Advisories, no public issues for vulnerabilities, best-effort single-maintainer response with no SLA, coordinated disclosure preferred.",
          "is_bot": false,
          "headline": "Add SECURITY.md with private vulnerability reporting policy",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-17T16:33:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f1529af475b1ea293616f825b22fd8b1d0afc426",
          "body": "Implement the wire-level generation floor of ADR 0022 against spec §3.9/§6.13.\n\n- GenerationExt (name `gen`): a self-naming typed claim carrying the issuing\n  entity's own generation and an optional opaque template digest, minted through\n  the standard WithExtension plumbing and recovered with ExtOf\n[…]\n rejected by a floor, and a\nverifier without WithGenerationFloors ignores stamps. Adds the\ngenerationCases generator and the verify_generation_floor conformance op.\n\nTargets 0.14.0; no tag or release.",
          "is_bot": false,
          "headline": "Add entity generation-floor extension and enforcement (ADR 0022)",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-17T13:29:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f793667e98eace41020a338a72e110a2ac6d7155",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.13.1",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-17T11:33:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a5068ad0631bdb01a68a728b71c9ef9be06b6bfe",
          "body": "Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.59.0 to 0.59.1.\n- [Release notes](https://github.com/quic-go/quic-go/releases)\n- [Commits](https://github.com/quic-go/quic-go/compare/v0.59.0...v0.59.1)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/quic-go/quic\n[…]\ngo\n  dependency-version: 0.59.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 (#18)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T11:29:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "14ea20ffec0b05823845feff4b6be87f6a251ad9",
          "body": null,
          "is_bot": false,
          "headline": "ci: add test workflow gating pushes and PRs (#19)",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-17T11:23:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a9f194507bd3c6959285d1f228dbcda8092a527",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.13.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T16:15:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c368f38afb01163914d12e4fee7991b5dfa58e2",
          "body": null,
          "is_bot": false,
          "headline": "Fix AGENTS.md contrib-rule reference: org ADR renumbered to 0015",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T15:10:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "34190b718fbfcd9abc726091c03348c0c988259a",
          "body": null,
          "is_bot": false,
          "headline": "Record the auth/sig contrib package rule in AGENTS.md (org ADR 0013)",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T13:53:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0937a23f59934f00cd2b203672e6210ac08cc26f",
          "body": "Native receiving middleware over the httpsig core, carrying the\nvaliss-chain: required negotiation signal through each framework's own\nrejection path (gin abort, echo.HTTPError) and exposing the verified\nclaims via MessageFrom helpers on the framework contexts. Emitters stay\non the framework-agnostic httpsig.NewTransport. Tests cover the\nverified round trip, tamper rejection, and full chain negotiation\nagainst a chain cache.",
          "is_bot": false,
          "headline": "Add Gin and Echo message-token adapters: contrib/ginsig, contrib/echosig",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T13:39:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1da231d37cdbd8c6508d9fea92c4afa41834064",
          "body": "Framework adapters need the same message-token verification the\nnet/http middleware performs: token extraction, body binding,\nchain-negotiation state, and verification over a plain *http.Request.\nExtract it into an exported Receiver (NewReceiver /\nNewKeyringReceiver): rejections are *httpsig.Error c\n[…]\nin-negotiation signal for adapters' own rejection paths.\nMiddlewareOption now configures the Receiver; NewMiddleware and\nNewKeyringMiddleware delegate to the same core and their behavior is\nunchanged.",
          "is_bot": false,
          "headline": "Export the httpsig receiving core as Receiver",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T13:39:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6252625bcd784c7da8ba3741f1093b5035713f8",
          "body": "First wave of framework integrations per ADR 0012 (stars-and-effort\nordering): native middleware over the httpauth verification core,\nrejecting through each framework's own mechanism (gin abort with plain\ntext, echo.HTTPError for the app's error handler) and exposing the\nverified identity via IdentityFrom helpers on the framework contexts.\nThe client side stays the framework-agnostic httpauth.NewTransport.\nRunnable demos: examples/ginauth, examples/echoauth.",
          "is_bot": false,
          "headline": "Add Gin and Echo adapters: contrib/ginauth, contrib/echoauth",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T13:31:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "032308b56b776610829c752b15a72e31c55428c3",
          "body": "Framework adapters need the same credential extraction, verification,\nand fail-closed extension enforcement the net/http middleware performs,\nover a plain *http.Request. Extract it into an exported Authenticate\nfunction: rejections are *httpauth.Error carrying the HTTP status, and\nStatusOf maps any error to a response status, defaulting to 401 so\nverification failures never widen access. NewMiddleware delegates to\nthe same core; behavior is unchanged.",
          "is_bot": false,
          "headline": "Export the httpauth verification core as Authenticate",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-16T13:31:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e525f7a73f4ea59f020f736573d5a6ab5573a52",
          "body": "conformance/gen mints fixed-key artifacts and emits the spec-1 vector set;\nconformance/ runs the reference against those vectors, mapping errors to the\nSPEC-1 reason codes. Vectors live in the spec repo; the runner skips when the\nvector dir is absent. See ADR 0010.",
          "is_bot": false,
          "headline": "Add spec-1 conformance vectors generator and runner",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-15T16:47:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8263f65511a18df563a2445599b8ed0c3ca45ca9",
          "body": "The offline-verify recipe missed the ver:1 header field and the\nvaliss-req-v1 request-signature prefix added in 0.12.0, so a reimplementation\nfollowing it would not verify. Bring it in line with the code.",
          "is_bot": false,
          "headline": "docs: update VERIFYING.md for wire version 1",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-15T16:12:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84a4587de8fc2e26a5ef8d2539652197638e4fdf",
          "body": "…minator\n\nTwo coupled changes for the v0.12.0 release:\n\n- Module path is now valiss.dev/valiss (was github.com/mikluko/valiss),\n  served as a vanity import from the project domain. Releases before this one\n  declared the old path and do not resolve under the new one.\n\n- Add an explicit wire-format v\n[…]\ndeV1, ...) while the\n  public API and Claims types stay version-free. Pre-freeze artifacts lack\n  the discriminator and must be reissued.\n\nSee ADR 0001 (module path) and 0009 (wire-format versioning).",
          "is_bot": false,
          "headline": "Rename module to valiss.dev/valiss and add wire-format version discri…",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-15T15:58:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2947d49083111db24c701837f89410cfad6eb6f2",
          "body": null,
          "is_bot": false,
          "headline": "docs: acknowledge AI assistance in README",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T17:20:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "387bc1b87c40a32a56b4902cfe34062dc4c07ee1",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.11.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T17:19:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b1ccd60fa6de46541cef8aa86610873f4f265c5",
          "body": "feat: keyring-backed request authentication",
          "is_bot": false,
          "headline": "Merge pull request #17 from mikluko/feat/keyring-auth",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T17:18:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9667198346e3da79502aeae5d59951faf3aed53f",
          "body": "NewKeyringVerifier is the multi-anchor counterpart of NewVerifier: the\ncredential's account-token issuer and epoch select exactly one keyring\nentry, the entry's validity window and epoch are always enforced across\nthe chain, and the matched trust domain lands on the new\nIdentity.Operator (also popul\n[…]\nToken does not combine with a keyring (entries carry the\npolicy); the allowlist is shared across domains, safe because account\ntoken jtis are content hashes and cannot collide between producers. (#13)",
          "is_bot": false,
          "headline": "feat: keyring-backed request authentication",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T17:16:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1377e9c3961d1d21efba89fde829073bb5e088dc",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.10.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T16:29:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e67d08f562ba06268edc1f2e6a22364566218d21",
          "body": "feat: operator keyring for multi-producer message verification",
          "is_bot": false,
          "headline": "Merge pull request #16 from mikluko/feat/operator-keyring",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T16:27:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b7e67fb239acd223b831dcecbd5922b148b9175",
          "body": null,
          "is_bot": false,
          "headline": "docs: disambiguate request signatures from message-token bindings",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T16:26:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb967fd6dd10f7ebbcb58d34438650a6021c84b6",
          "body": "docs/VERIFYING.md is the complete recipe for verifying valiss tokens\nwithout the library: wire format, nkey decoding (prefix roles, CRC16),\njti derivation, single-level and full-chain verification, and request\nsignatures. Validated by an independent stdlib-only implementation\nreproducing every step \n[…]\n-encoded\niss/sub) and justifies the trade: key role lives in the key material, so\nthe strict signing hierarchy is checkable at every chain hop, and no\nstock JWT middleware could walk the chain anyway.",
          "is_bot": false,
          "headline": "docs: verification port guide and interoperability statement",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T16:24:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d5143a3d470b98560870e2040bdd134c45ec05a",
          "body": "The anchor callback loses its unused instant parameter (window and epoch\nchecks on the anchor's result live in the verification core), and the\nkeyring test fixture carries its domain name so reissueAt preserves it\ninstead of hardcoding one.",
          "is_bot": false,
          "headline": "refactor: address review notes on the keyring PR",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T16:12:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5dfea56b3eb8d81352302c8b6c43656ee34b433d",
          "body": "A consumer receiving messages from several independent producers verifies\nagainst a Keyring of trusted operators instead of a single anchor. Every\nentry is a full self-signed operator token, never a bare public key, so\neach trust domain always carries a name, an epoch, and a validity window,\nand per\n[…]\niddleware and grpcsig.KeyringUnaryServerInterceptor,\ncomposing with chain negotiation and caching unchanged.\n\nMulti-anchor request authentication (Verifier over a Keyring) is the next\niteration. (#13)",
          "is_bot": false,
          "headline": "feat: operator keyring for multi-producer message verification",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T13:50:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7141c2b6e5eae93fedd7f3111d2b7675282beea8",
          "body": "refactor: name issuance consistently, deprecate Issue in favor of IssueAccount",
          "is_bot": false,
          "headline": "Merge pull request #15 from mikluko/refactor/consistent-naming",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T13:24:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e728b5487ee349355c4581d24b02e9f988299b79",
          "body": "…ueAccount\n\nThe account-token minter was the library's original single entry point\nand kept the bare name while later levels got suffixed ones. IssueAccount\ncompletes the quartet (IssueOperator/IssueAccount/IssueUser/IssueMessage);\nIssue stays as a deprecated wrapper with the same signature, and all\ninternal callers, examples, and docs use the new name. (#13)",
          "is_bot": false,
          "headline": "refactor: name issuance consistently, deprecate Issue in favor of Iss…",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T13:18:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "29c959b0fdbfa83b9ea1cc4b8a2e3e32886f1d0c",
          "body": "feat!: optional names at every level via WithName; operator tokens gain a name",
          "is_bot": false,
          "headline": "Merge pull request #14 from mikluko/feat/operator-name",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T13:12:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e623ae11d965182dad61842eb88fabcb3e221ad",
          "body": "…in a name\n\nNaming becomes uniform: every identity level (operator, account, user)\ntakes an optional WithName issue option, and an entity minted without one\nis represented by its public key. Operator tokens, previously nameless,\nnow carry a trust-domain label surfaced as OperatorClaims.Name with the\n[…]\nenantPubKey, ...) becomes\nIssue(operator, tenantPubKey, valiss.WithName(name), ...);\nIssueUser(account, name, userPubKey, ...) becomes\nIssueUser(account, userPubKey, valiss.WithName(name), ...). (#13)",
          "is_bot": false,
          "headline": "feat!: optional names at every level via WithName; operator tokens ga…",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T13:09:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c325c3744c0b041b01141a59620dcbb8f9579c80",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.9.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T11:29:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ce00f0faf1d8463d001ff7f69c7010d8f0d092a",
          "body": "feat: negotiated chain caching for message-token transports",
          "is_bot": false,
          "headline": "Merge pull request #12 from mikluko/feat/chain-negotiation",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T11:28:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a3b239d1c6fcbe625001734d37ce8f60c104c45",
          "body": "Emitters opting in with WithChainNegotiation send bare ~650 B message\ntokens instead of embedding the ~1.4 KB chain in each one. A receiver\nthat cannot verify a chainless token answers the valiss-chain: required\nsignal (response header on HTTP, trailer on gRPC), and the transport\nretransmits once wi\n[…]\nCache interface with\na process-local MemoryChainCache.\n\nBREAKING: httpsig.NewMiddleware and grpcsig.UnaryServerInterceptor take\npackage options now; wrap previous arguments in WithVerifyOptions. (#11)",
          "is_bot": false,
          "headline": "feat: negotiated chain caching for message-token transports",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T09:58:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1d5ebe5b80b1e1d7d5f644cc5c7f0e1a17bcb4b8",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.8.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T08:47:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8dcfe887093dae124bcb02a537e96d6853b176b3",
          "body": "feat: message tokens — per-message proofs of origin (core + httpsig/grpcsig transports)",
          "is_bot": false,
          "headline": "Merge pull request #10 from mikluko/feat/message-tokens",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T08:46:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97809d1ec3055b86990eed45960562001baecf3a",
          "body": "…rpcsig\n\nProof-of-origin wiring moves out of the request-auth packages into\ndedicated contrib packages, separating the two concerns the way the\nscheme itself does (credentials vs proofs) and shortening the names:\nhttpsig.NewTransport/NewMiddleware and\ngrpcsig.UnaryClientInterceptor/UnaryServerInterc\n[…]\nst-expiry re-verification of a\nstored message at its receipt instant) and examples/grpcsig (signed\nunary call, unsigned and cross-method and tampered calls rejected over\nan in-memory connection). (#9)",
          "is_bot": false,
          "headline": "refactor: split message transports into contrib/httpsig and contrib/g…",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T08:42:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dcf37497bc2afa3fd2319d0b8f35fee981d14fa3",
          "body": "httpauth gains NewMessageTransport (a RoundTripper minting a proof of\norigin per outgoing request, audience = host + path, checksum over the\nbody) and NewMessageMiddleware verifying it against the operator public\nkey. grpcauth gains the equivalent unary interceptor pair, binding the\nfull method and \n[…]\nia valiss.MessageFromContext, and the mint window\ndefaults to valiss.DefaultMessageTTL (30s). The transports pin the\naudience and payload bindings after caller options so they cannot be\nweakened. (#9)",
          "is_bot": false,
          "headline": "feat: message-token transports for HTTP and gRPC in contrib",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T08:31:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1862a7226412e85777f8a73bfaed9df88441a646",
          "body": "…rigin\n\nA user key can now mint short-lived, self-signed message tokens\n(IssueMessage) binding a destination (aud, new on the wire format), a\npayload checksum, and the trust-domain epoch. VerifyMessage walks the full\noperator -> account -> user -> message chain offline against the operator\npublic ke\n[…]\ncredentials: possession grants nothing and\nthe request Verifier never accepts them. Beyond the issue text, an expiry\nis mandatory at mint: an eternal proof of origin only widens capture\nexposure. (#9)",
          "is_bot": false,
          "headline": "feat: message tokens, a fourth chain level of per-message proofs of o…",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T08:24:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "425e9be936961bc4586f1baba543958dec5753c3",
          "body": "docs: clarify empty dimension wildcards in HTTP extension",
          "is_bot": false,
          "headline": "Merge pull request #8 from mikluko/copilot/security-review-go-library",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-13T08:02:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "17d1a609c473d31b3e0ea8fe857b760b2319c3bf",
          "body": null,
          "is_bot": false,
          "headline": "docs: cut CHANGELOG 0.7.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T12:07:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "07a86f166ebef59941b45aa041e7a758d2908ed3",
          "body": "Keep a Changelog format, hand-curated with migration notes. The\n[Unreleased] section holds the #4-#7 fixes for the next release.\nCHANGELOG.md is now the source of truth; GitHub Release bodies are\npasted from it (noted in AGENTS.md).",
          "is_bot": false,
          "headline": "docs: add CHANGELOG, backfilled v0.1.0-v0.6.0",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T11:59:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7c9446148d34a98b104a24864422c0080fffae82",
          "body": "A Verifier built with WithReplayCache(cache) rejects a signed request\nwhose nonce it has already seen, closing the same-operation replay window\nthat context binding (#6) leaves open. The nonce is folded into the signed\nrequest context, so it cannot be altered without breaking the signature,\nand is r\n[…]\nche is the pluggable interface; NewMemoryReplayCache is a\nprocess-local implementation, with multi-instance exactly-once left to\nshared storage. valiss.NewNonce generates the client value.\n\nCloses #7.",
          "is_bot": false,
          "headline": "feat: opt-in nonce and replay cache for same-request replay suppression",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T11:52:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07e8bc75dc84143fa0b3c3360f6fa02bd31ae9cb",
          "body": "The per-request signature now commits to a request-context byte string,\nnot the timestamp alone, so a captured signature can no longer authorize\na different operation (a GET /a signature replayed against POST /b is\nrejected). SignRequest and VerifySignature take a context []byte;\nvaliss.Request gain\n[…]\n/VerifySignature signatures change, and signatures\nfrom older clients no longer verify. Target 0.7.0.\n\nSame-request replay within the skew window is unaffected and tracked\nseparately (#7).\n\nCloses #6.",
          "is_bot": false,
          "headline": "feat!: bind transport request context to the per-request signature",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T11:48:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94ef3c56783b28e398d2a4a74f377c03d5d6b400",
          "body": "between now requires exactly one payload line followed by the END\nmarker; an empty, unclosed, or multi-line section is an error. A\ntruncated or line-wrapped creds file fails at parse time instead of\nsurfacing downstream as a confusing malformed-token or signature error.\n\nCloses #5.",
          "is_bot": false,
          "headline": "fix: strict creds section parsing requires the end marker",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T11:39:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "372d5bfbad0bcc8fe4c051568ce93aa5e99102be",
          "body": "The bearer gate and per-request signature check now run before the\nregistered extension-type checks and custom validators, so a party that\ncaptured a token but cannot sign never triggers an expensive validator.\nBearer requests still fall through to the hooks; only the possession\nproof moved ahead of them.\n\nCloses #4.",
          "is_bot": false,
          "headline": "fix: verify request signature before running consumer validators",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T11:38:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ccb4b0a7e7d80fc5fdab4db7f872f7f158fcc60",
          "body": null,
          "is_bot": true,
          "headline": "Update Ext godoc in httpauth",
          "author_name": "copilot-swe-agent[bot]",
          "author_login": "Copilot",
          "committed_at": "2026-07-10T11:37:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f3974593890007422ce569cab58c47cd18d842e",
          "body": "The three Ext dimensions constrain only when populated: naming one\nleaves the others open (Ext{Paths: [\"/admin/*\"]} permits any method).\nDocument the read-only-admin footgun on the type, its fields, and the\nREADME so nobody models the multi-dimension HTTP extension like the\nsingle-dimension grpcauth.Ext. No behavior change; the zero value still\ndenies (v0.5.1, #2).",
          "is_bot": false,
          "headline": "docs: clarify httpauth.Ext per-dimension AND-filter semantics",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T11:36:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "212b4ac5d43ec839dbc8e0a8a432a126ba45c3d1",
          "body": "The post-activation assertion used a 1h account token against a +2h\nclock, so it hit account expiry instead of proving the domain opened.\nUse a long-lived token and a signature timestamped at the active clock.",
          "is_bot": false,
          "headline": "test: fix operator nbf activation case",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T10:53:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2062914353585b9e1448ab3421a7eec181679c3",
          "body": null,
          "is_bot": false,
          "headline": "test: operator token nbf gates the domain until activation",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T10:52:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14060f7ee5e2e512ba5a8a80348e553e6c1ea39f",
          "body": "The operator can publish a self-signed operator token (IssueOperator):\na domain policy statement carrying an explicit epoch counter plus an\noptional validity window, signed by the anchor key over itself.\nVerifiers configured with WithOperatorToken enforce it on every\nrequest: the operator token must\n[…]\nnal influences: the README gains a Prior art\nsection (NATS/nsc, RFC 7519, RFC 8032, golang-jwt, Biscuit/Macaroons,\nSPIFFE) and the \"modeled on NATS\" framing is gone from docs and\ncomments.\n\nCloses #3.",
          "is_bot": false,
          "headline": "feat: self-signed operator token with epoch for mass revocation",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-10T10:42:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "db3b7e6ce45a35c58dbf3642cec0dfdedd59b8f2",
          "body": "Transport authorization no longer fails open. Every token in the chain\nmust carry the transport extension or the request is denied\n(PermissionDenied / 403); deployments that authorize entirely outside\nthe transport opt out with AllowMissingExtension() on the authenticator\nor middleware. An empty gra\n[…]\n an\nempty Methods list and the zero-value httpauth.Ext deny everything, and\nallow-all is the explicit \"*\" wildcard. A non-zero httpauth.Ext still\nleaves its empty dimensions unconstrained.\n\nCloses #2.",
          "is_bot": false,
          "headline": "fix!: fail-closed transport extension enforcement",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T20:34:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "563733db7e9c20afa0f8e79d21edf42d3b3c5e06",
          "body": "The base Claims struct carries only RFC 7519 registered claims (jti,\niss, sub, iat, exp, nbf); AccountClaims{Claims, Name, Ext} and\nUserClaims{Claims, Name, Bearer, Ext} embed it, golang-jwt/NATS style.\nVerifyRequest returns Identity{Account, User} and the context accessors\nare ContextWithIdentity/I\n[…]\nnsports use.\n\nThe httpauth example demos the driving use case: a domain extension\ncarrying data-query filters, decoded to its concrete type in the\nhandler. The minter manifest drops its scopes fields.",
          "is_bot": false,
          "headline": "feat!: RFC-pure claims, typed identities, self-naming extensions",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T19:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ea0ecc6a3ea80f4d2dfe2402a71633d92edc9827",
          "body": "The CLI example is examples/minter: manifest types folded into main.go,\nmanifest tests merged into main_test.go, tool and default manifest named\nminter (minter.yaml), plus a usage README.",
          "is_bot": false,
          "headline": "refactor: single-file minter example",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T19:04:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a72324681973dc5ce323613d9e3dc657b2377c50",
          "body": null,
          "is_bot": false,
          "headline": "docs: motivate the library before explaining it",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T18:56:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4611bbc85323bf1219b5ab544c995b3e7fea6e1",
          "body": "The repository is a library now: the core token package lives at the\nmodule root (package valiss), creds sits beside it, and the transport\nadapters move to contrib/httpauth and contrib/grpcauth. The CLI and its\nmanifest are demoted to examples/cli.\n\nExtension claims are named: WithExtension(name, v)\n[…]\nusers. The call: scope convention,\nWithMethodScope, WithPathScope, and WithScopeMapper are gone; scopes\nremain consumer-defined strings with the subset clamp.\n\nExamples demo the extensions end to end.",
          "is_bot": false,
          "headline": "feat!: typed transport extensions, library-first layout",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T18:54:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "17c04d438ffa6b02c0a46568c043233133465b6c",
          "body": "Tokens are now valiss's own typed claims in a hand-rolled nkey-signed\nJWT (pkg/token/claims.go): RFC 7519 standard fields plus a valiss\nsection carrying type, scopes, the bearer flag, and an opaque ext\nclaim. The NATS jwt library dependency is gone; only nkeys remains for\ncrypto. Verify splits into \n[…]\nextend tokens with WithExtension(v): the ext claim is signed\nand transported opaquely, surfaces as Claims.AccountExt/UserExt, and\nvalidates through the typed ExtValidator adapter or the Ext[T] helper.",
          "is_bot": false,
          "headline": "feat!: own typed claims with consumer extensions",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T18:26:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a8d0dcd34a1b18abeb2c4fdbb566be7c9a4b402d",
          "body": "Tokens now follow NATS conventions end to end: the JWT sub claim is the\nsubject's public key and name carries the human label (the subject_key\ncustom claim is gone; scopes is the only custom claim), expiry is\noptional (no exp = never expires, nsc's default), and nbf is supported\nat issuance (WithNot\n[…]\n/not_before boundaries instead of relative\nTTLs, so re-minting yields the same validity window; minting an entry\nwhose window has closed is refused. Metadata output uses the same\nexpanded field names.",
          "is_bot": false,
          "headline": "feat!: NATS-conventional tokens and a deterministic manifest",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T17:59:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3f4f8d1ff2b9251ebe0072e6e43487c1caf4c361",
          "body": "The per-request header material is a Request, verified by\nVerifier.VerifyRequest; the former package-level VerifyRequest\n(signature check) is now VerifySignature. Credential was misleading:\ncreds files and grpc credentials are different things.",
          "is_bot": false,
          "headline": "refactor!: token.Credential -> token.Request",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T15:21:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d136f1ccbec14cc49b31bffc6e0492a2af27460c",
          "body": "Creds.Token and Credential.Token become AccountToken; the wire headers\nare valiss-account-token, valiss-user-token, valiss-timestamp, and\nvaliss-signature (the tenant- prefix was wrong for user-signed\nrequests); the bound-key JWT claim is subject_key, naming what it binds\nat both levels. Error messages say account token. Breaks the wire\nheader names and previously issued tokens.",
          "is_bot": false,
          "headline": "refactor!: account-token naming through fields, headers, and claims",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T15:16:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e48b98d696772ae186defdda976429cf43c1d3c",
          "body": "The account token section marker is BEGIN/END VALISS ACCOUNT TOKEN,\nconsistent with the user token marker. Changes the creds file format;\nfiles written by earlier versions no longer parse.",
          "is_bot": false,
          "headline": "fix: name the account token marker in creds files",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T15:09:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa34e4be5a7fde38862e98a78c0a3d544675f2ae",
          "body": "Creds are the credentials file (subject token + seed); a bundle is the\nkind of creds that also carries the upstream account token. The type is\ncreds.Creds (was Bundle) and the CLI flag is -bundle (was\n-with-account-token).",
          "is_bot": false,
          "headline": "refactor!: creds/bundle terminology, -bundle flag",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T14:58:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b8485df1c7bbeed814f47ea2139693e8344ddd41",
          "body": "…e chain\n\nUser credentials carry only the user token and seed unless\n-with-account-token is passed; the previous -no-account-token opt-out is\ngone. The lean default needs just the account seed at mint time and\nexpects the server to resolve account tokens (WithAccountTokenResolver).",
          "is_bot": false,
          "headline": "feat!: lean user bundles by default, -with-account-token opts into th…",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T14:40:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "02dbae9205226267cdd00fb558196b0837880c0d",
          "body": "A user bundle minted with `creds -no-account-token ACCOUNT/USER` carries\nonly the user token and seed; the operator seed is not needed at mint\ntime, so an account holder can issue its own users. Servers accept such\nrequests through WithAccountTokenResolver (StaticAccountTokens helper\nfor fixed confi\n[…]\ntor-signature, expiry, and allowlist\nchecks as an embedded one.\n\nCreds bundles now require at least one token section instead of always\nthe account token; transports omit the empty header accordingly.",
          "is_bot": false,
          "headline": "feat: -no-account-token bundles and server-side account resolution",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T14:37:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "56170ca35a283f6ca8e4506d82899fee6490bb0a",
          "body": "The manifest describes one trust domain: a top-level operator key with\nits accounts, instead of a list of operator blocks. Drops the ambiguity\nhandling in account lookup.",
          "is_bot": false,
          "headline": "refactor: single operator per manifest",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T13:23:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3bc89a8ab93008229fd5926a52779c88017be12d",
          "body": "Inject custom validation into the Verifier pipeline: validators run\nafter the token chain is verified and the effective claims assembled,\nbefore the request signature check. Registration order, first error\nrejects the request as unauthenticated.",
          "is_bot": false,
          "headline": "feat: WithClaimsValidator verification hook",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T13:16:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "543cd38f31855eca524049b9dc298dfadc33cfc5",
          "body": "Rename the issuer role to operator and add the Account -> User level:\naccounts sign scoped user tokens with their account seed, servers verify\nthe chain up to the pinned operator key and clamp user scopes to the\naccount grants. The allowlist stays keyed by account jti; user-level\nrevocation relies o\n[…]\nearer, scopes\nlist-only and validated as a subset of the account's.\n\nTransports gain the valiss-user-token header and bundle-driven client\nconstructors; creds files carry an optional USER TOKEN block.",
          "is_bot": false,
          "headline": "feat: three-level credentials — operator/account/user",
          "author_name": "Mikhail Lukianchenko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T13:04:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fa672a840c2674352c3d84427025f814dc862166",
          "body": "VALidator-ISSuer: an issuer nkey signs scoped, time-limited tenant\ntokens; tenants sign every request with their own nkey; servers verify\ntoken, allowlist membership, and request signature, then hand the\ntenant identity to handlers. Library under pkg/ (token, creds,\ngrpcauth, httpauth), stateless CLI at the root.",
          "is_bot": false,
          "headline": "feat: valiss — NATS-style tenant auth for gRPC and HTTP",
          "author_name": "mikluko",
          "author_login": "mikluko",
          "committed_at": "2026-07-09T12:16:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 3,
      "commits_last_year": 66,
      "latest_release_at": "2026-07-17T11:36:35Z",
      "latest_release_tag": "v0.13.1",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 2,
      "days_since_latest_release": 5,
      "mean_days_between_releases": 0.4
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": 37,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "valiss.dev/valiss",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": null,
          "registry_url": "https://pkg.go.dev/valiss.dev/valiss",
          "is_deprecated": false,
          "latest_version": "v0.13.1",
          "repository_url": null,
          "versions_count": 5,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-17T11:33:10Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0
      },
      "open_issues_and_prs": 6
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 36800,
      "source_files_sampled": 60,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md"
      ],
      "agent_instruction_max_bytes": 11913
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 0
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 14
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 8
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 2,
          "critical": 1
        },
        "advisory_count": 3,
        "affected_count": 3,
        "assessed_count": 42,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/gin-gonic/gin",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.12.0"
        },
        {
          "name": "github.com/labstack/echo/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.15.4"
        },
        {
          "name": "github.com/nats-io/nkeys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.16"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.0"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.11"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/gin-gonic/gin",
            "direct": true,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/labstack/echo/v4",
            "direct": true,
            "version": "v4.15.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nats-io/nkeys",
            "direct": true,
            "version": "v0.4.16",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytedance/gopkg",
            "direct": false,
            "version": "v0.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytedance/sonic",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytedance/sonic/loader",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudwego/base64x",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gabriel-vasile/mimetype",
            "direct": false,
            "version": "v1.4.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gin-contrib/sse",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-playground/locales",
            "direct": false,
            "version": "v0.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-playground/universal-translator",
            "direct": false,
            "version": "v0.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-playground/validator/v10",
            "direct": false,
            "version": "v10.30.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/labstack/gommon",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/leodido/go-urn",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quic-go/qpack",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quic-go/quic-go",
            "direct": false,
            "version": "v0.59.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/twitchyliquid64/golang-asm",
            "direct": false,
            "version": "v0.15.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ugorji/go/codec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/bytebufferpool",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/fasttemplate",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "go.mongodb.org/mongo-driver/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/arch",
            "direct": false,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260414002931-afd174a4e478",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 42,
        "direct_count": 7,
        "indirect_count": 35
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 10,
        "open_issues": 6,
        "closed_ratio": 0.6,
        "closed_issues": 9,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "mikluko",
          "commits": 65,
          "avatar_url": "https://avatars.githubusercontent.com/u/42915?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "test.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 4,
            "reason": "3 out of 7 merged PRs checked by a CI test -- score normalized to 4",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/21 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 4,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "bee2637d4d1922e7f5a6f6dd4bdd15feb47c729c",
        "ran_at": "2026-07-22T19:06:25Z",
        "aggregate_score": 4.8,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-22T10:55:53Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-22T10:55:18Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 21,
          "created_at": "2026-07-17T16:35:47Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 22,
          "created_at": "2026-07-17T16:35:49Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 23,
          "created_at": "2026-07-17T16:35:50Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 24,
          "created_at": "2026-07-17T16:36:02Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 25,
          "created_at": "2026-07-17T16:36:03Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 26,
          "created_at": "2026-07-17T16:36:05Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/valiss-dev/valiss-go",
    "host": "github.com",
    "name": "valiss-go",
    "owner": "valiss-dev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 52,
      "inputs": {
        "security": 52,
        "vitality": 72,
        "community": 24,
        "governance": 50,
        "engineering": 56
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 72,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "commits_last_year": 66,
              "human_commit_share": 0.97,
              "days_since_last_push": 0,
              "active_weeks_last_year": 2
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "2/52 weeks with commits",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "66 commits in the last year",
                "points": 16.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 66
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 3,
              "latest_release_tag": "v0.13.1",
              "releases_from_tags": false,
              "days_since_latest_release": 5,
              "mean_days_between_releases": 0.4
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "3 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.4 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 50,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 63,
            "inputs": {
              "merged_prs": 10,
              "open_issues": 6,
              "closed_issues": 9,
              "issue_closed_ratio": 0.6,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "60% of issues closed",
                "points": 28.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 60
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "10/11 decided PRs merged",
                "points": 34.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 10,
                      "decided": 11
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/21 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "followers": 1,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "valiss-dev",
              "public_repos": 9,
              "account_age_days": 9
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of valiss-dev",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "valiss-dev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "9 public repos, account ~0 yr old",
                "points": 7.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 9
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "valiss.dev/valiss"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "5 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 56,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "3 out of 7 merged PRs checked by a CI test -- score normalized to 4",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 52,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 4.8
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "3 out of 7 merged PRs checked by a CI test -- score normalized to 4",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/21 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 42 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 42
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 3,
              "assessed_packages": 42,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, unknown 2",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: google.golang.org/grpc v1.82.0 (critical 9.1)",
                "points": 9.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "google.golang.org/grpc v1.82.0 (critical 9.1)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 42,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 72,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.969,
              "agent_instruction_files": [
                "AGENTS.md"
              ],
              "agent_instruction_max_bytes": 11913
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "63 of 65 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 63,
                      "sampled": 65
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 64,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.015
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 67",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 67
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "1 of the last 67 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 1,
                      "sampled": 67
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 36800,
              "source_files_sampled": 60,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/60 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 60,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [],
  "report_type": "repository",
  "generated_at": "2026-07-22T19:06:36.151606Z",
  "schema_version": "0.26.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/v/valiss-dev/valiss-go.svg",
  "full_name": "valiss-dev/valiss-go",
  "license_state": "standard",
  "license_spdx": "MIT"
}