{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://w3id.org/traceability/v1"
  ],
  "id": "urn:uuid:07aa969e-b40d-4c1b-ab46-ded252003ded",
  "name": "Verifiable Scorecard",
  "description": "Scorecard is an automated tool that performs a number of checks on source code",
  "type": [
    "VerifiableCredential",
    "VerifiableScorecard"
  ],
  "issuer": "did:key:z6MktHQo3fRRohk44dsbE76CuiTpBmyMWq2VVjvV6aBSeE3U",
  "issuanceDate": "2010-01-01T19:23:24Z",
  "credentialSubject": {
    "id": "https://github.com/ossf/scorecard",
    "items": [
      {
        "score": "10",
        "name": "Binary-Artifacts",
        "reason": "no binaries found in the repo",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#binary-artifacts"
      },
      {
        "score": "9",
        "name": "Branch-Protection",
        "reason": "branch protection is not maximal on development and all release branches",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection"
      },
      {
        "score": "?",
        "name": "CI-Tests",
        "reason": "no pull request found",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#ci-tests"
      },
      {
        "score": "0",
        "name": "CII-Best-Practices",
        "reason": "no badge found",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#cii-best-practices"
      },
      {
        "score": "10",
        "name": "Code-Review",
        "reason": "branch protection for default branch is enabled",
        "documentation": "github.com/ossf/scorecard/blob/main/docs/checks.md#code-review"
      },
      {
        "score": "0",
        "name": "Contributors",
        "reason": "0 different companies found -- score normalized to 0",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#contributors"
      },
      {
        "score": "0",
        "name": "Dependency-Update-Tool",
        "reason": "no update tool detected",
        "documentation": "github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool"
      },
      {
        "score": "0",
        "name": "Fuzzing",
        "reason": "project is not fuzzed in OSS-Fuzz",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#fuzzing"
      },
      {
        "score": "1",
        "name": "Maintained",
        "reason": "2 commit(s) found in the last 90 days -- score normalized to 1",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained"
      },
      {
        "score": "?",
        "name": "Packaging",
        "reason": "no published package detected",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#packaging"
      },
      {
        "score": "8",
        "name": "Pinned-Dependencies",
        "reason": "unpinned dependencies detected -- score normalized to 8",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies"
      },
      {
        "score": "0",
        "name": "SAST",
        "reason": "no SAST tool detected",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast"
      },
      {
        "score": "0",
        "name": "Security-Policy",
        "reason": "security policy file not detected",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#security-policy"
      },
      {
        "score": "?",
        "name": "Signed-Releases",
        "reason": "no releases found",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases"
      },
      {
        "score": "10",
        "name": "Token-Permissions",
        "reason": "tokens are read-only in GitHub workflows",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions"
      },
      {
        "score": "10",
        "name": "Vulnerabilities",
        "reason": "no vulnerabilities detected",
        "documentation": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#vulnerabilities"
      }
    ]
  }
}