Free scanner / gin-gonic
gin-gonic/gin
Gin is a high-performance HTTP web framework written in Go. It provides a Martini-like API but with significantly better performance—up to 40 times faster—thanks to httprouter. Gin is designed for building REST APIs, web applications, and microservices.
75
/ 100
Good
ops
92
deps
80
docs
100
ci_cd
77
docker
63
security
68
Issues
0 critical · 7 warnings
CODEOWNERS is configuredwarn
CODEOWNERS automatically requests review from the right people on security-critical paths.
Create .github/CODEOWNERS:
* @team-lead
/config/ @security-team
Tests run in CIwarn
Running the test suite on every commit is what stops a regression from reaching production.
Add a test step to the pipeline (pytest, jest, go test — whatever your stack uses).
Dockerfile presentwarn
A Dockerfile gives everyone — and production — the same reproducible runtime.
Add a Dockerfile at the repository root. Use a multi-stage build to keep the final image small.
Container runs as a non-root userwarn
A container running as root turns a process escape into host access.
Add to the Dockerfile:
RUN addgroup -S app && adduser -S app -G app
USER app
Known vulnerabilities in dependencieswarn
1 of 32 dependencies have known vulnerabilities (0 critical, 0 high) according to OSV.dev. Examples: GO-2026-5932.
Upgrade the affected packages: golang.org/x/crypto 0.56.0.
Get the full list locally:
pip-audit # Python
npm audit --fix # Node.js
cargo audit # Rust
govulncheck ./... # Go
Then turn on Dependabot or Renovate so the next patch arrives as a pull request.
GitHub Actions pinned to a commit SHAwarn
7 action(s) are referenced by a moving tag, for example actions/checkout@v7. A tag can be repointed at malicious code without any change on your side.
Reference actions by full commit SHA:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Tools such as pin-github-action or Dependabot can do this and keep it updated.
Workflow permissions are least-privilegewarn
A workflow grants broad write permissions. If any action in it is compromised, the attacker can write to the repository.
Declare the minimum each job needs:
permissions:
contents: read
pull-requests: write # only where it is actually used
Security policy (SECURITY.md)info
Tells researchers how to report a vulnerability privately instead of opening a public issue.
Add SECURITY.md with a contact address and your expected response time.
.dockerignore configuredinfo
.dockerignore keeps .git, node_modules and secrets out of the build context.
Create .dockerignore with at least: .git, node_modules, __pycache__, .env, *.log
Observability tooling is wired ininfo
No monitoring library found. Without one, you learn about incidents from your users.
Add the three signals:
• Errors: sentry-sdk
• Metrics: prometheus-client plus a /metrics endpoint
• Traces: opentelemetry-sdk
• Logs: structlog or loguru for structured JSON output
Your own repositories, including the private ones
Connect GitHub or GitLab to audit private repositories, track the score over time, get an AI analysis of each issue, and open a fix as a pull request.
Create a free account →Badge for the README
Passed 24
No secrets committed to the repository
.env file is not committed
.env is ignored by git
Automated dependency updates
CI/CD pipeline configured
Default branch is protected
Linter or formatter configured
Security scanning in the pipeline
Healthcheck defined
Base image is pinned (not :latest)
Dockerfile uses a multi-stage build
Resource limits set in compose
README exists
README explains how to run the project
CHANGELOG maintained
CONTRIBUTING guide
Pull request / issue templates
Dependency manifest present
Lock file present
Dependencies pinned to exact versions
.gitignore configured
.env.example documents required variables
License specified
Repository is actively maintained