Free scanner / expressjs
expressjs/express
Fast, unopinionated, minimalist web framework for node.
78
/ 100
Good
ops
92
deps
60
docs
57
ci_cd
100
docker
63
security
86
Issues
0 critical · 5 warnings
CODEOWNERS is configuredwarn
CODEOWNERS automatically requests review from the right people on security-critical paths.
Create .github/CODEOWNERS:
* @team-lead
/config/ @security-team
Dockerfile presentwarn
A Dockerfile gives everyone — and production — the same reproducible runtime.
Add a Dockerfile at the repository root. Use a multi-stage build to keep the final image small.
Container runs as a non-root userwarn
A container running as root turns a process escape into host access.
Add to the Dockerfile:
RUN addgroup -S app && adduser -S app -G app
USER app
Lock file presentwarn
A lock file pins exact versions so the build you tested is the build you ship.
Generate a lock file: `pip freeze > requirements.lock`, `npm install`, `poetry lock`, `go mod tidy` or `cargo build` depending on your stack.
Known vulnerabilities in dependencieswarn
1 of 44 dependencies have known vulnerabilities (0 critical, 0 high) according to OSV.dev. Examples: GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx.
Upgrade the affected packages: qs 6.15.2.
Get the full list locally:
pip-audit # Python
npm audit --fix # Node.js
cargo audit # Rust
govulncheck ./... # Go
Then turn on Dependabot or Renovate so the next patch arrives as a pull request.
Security policy (SECURITY.md)info
Tells researchers how to report a vulnerability privately instead of opening a public issue.
Add SECURITY.md with a contact address and your expected response time.
.dockerignore configuredinfo
.dockerignore keeps .git, node_modules and secrets out of the build context.
Create .dockerignore with at least: .git, node_modules, __pycache__, .env, *.log
CHANGELOG maintainedinfo
A changelog tells users and your own team what actually changed between releases.
Add CHANGELOG.md and follow the keepachangelog.com format.
CONTRIBUTING guideinfo
A contribution guide lowers the barrier for the next person who wants to help.
Add CONTRIBUTING.md describing the flow: fork, branch, pull request, review.
Pull request / issue templatesinfo
Templates make sure every PR and bug report arrives with the context reviewers need.
Add .github/pull_request_template.md and .github/ISSUE_TEMPLATE/bug_report.md.
Observability tooling is wired ininfo
No monitoring library found. Without one, you learn about incidents from your users.
Add the three signals:
• Errors: sentry-sdk
• Metrics: prometheus-client plus a /metrics endpoint
• Traces: opentelemetry-sdk
• Logs: structlog or loguru for structured JSON output
Your own repositories, including the private ones
Connect GitHub or GitLab to audit private repositories, track the score over time, get an AI analysis of each issue, and open a fix as a pull request.
Create a free account →Badge for the README
Passed 22
No secrets committed to the repository
.env file is not committed
.env is ignored by git
Automated dependency updates
CI/CD pipeline configured
Tests run in CI
Default branch is protected
Linter or formatter configured
Security scanning in the pipeline
Healthcheck defined
Base image is pinned (not :latest)
Dockerfile uses a multi-stage build
Resource limits set in compose
README exists
README explains how to run the project
Dependency manifest present
Dependencies pinned to exact versions
.gitignore configured
.env.example documents required variables
License specified
Repository is actively maintained
GitHub Actions pinned to a commit SHA