Free scanner / octocat
octocat/Hello-World
My first repository on GitHub!
32
/ 100
Needs work
ops
0
deps
0
ci_cd
0
docker
0
security
80
Issues
1 critical · 6 warnings
Dependency manifest presentcrit
Without a manifest the environment cannot be reproduced or scanned for vulnerabilities.
Add a dependency file: requirements.txt or pyproject.toml (Python), package.json (Node), go.mod (Go), Cargo.toml (Rust).
Full guide: why it matters and how to fix it →
Why this result
Looked in: requirements.txt, requirements/base.txt, Pipfile, pyproject.toml, package.json, go.mod, Cargo.toml, pom.xml, build.gradle, build.gradle.kts, composer.json, Gemfile, mix.exs, pubspec.yaml — none found.
This is a false positive
Automated dependency updateswarn
Dependabot or Renovate opens pull requests as soon as a security patch is released.
Add .github/dependabot.yml so security patches arrive as pull requests instead of waiting for someone to notice them.
Full guide: why it matters and how to fix it →
This is a false positive
CI/CD pipeline configuredwarn
No CI configuration found. Every deploy is a manual step that can be skipped or done wrong.
Add .github/workflows/ci.yml (or .gitlab-ci.yml) that runs your tests and linter on every push.
Full guide: why it matters and how to fix it →
This is a false positive
Tests run in CIwarn
Running the test suite on every commit is what stops a regression from reaching production.
Add a test step to the pipeline (pytest, jest, go test — whatever your stack uses).
Full guide: why it matters and how to fix it →
Why this result
No CI configuration found.
This is a false positive
Default branch is protectedwarn
Branch protection stops anyone pushing straight to master without review.
Turn on branch protection for master: require a pull request and at least one approval before merging.
Full guide: why it matters and how to fix it →
This is a false positive
Security scanning in the pipelinewarn
A scanner in CI catches vulnerable dependencies and leaked secrets before they merge.
Add a scanning step to CI. Free options: Trivy for images and dependencies, gitleaks for secrets, CodeQL for code. Each is a single job in your existing workflow.
Full guide: why it matters and how to fix it →
This is a false positive
Dockerfile presentwarn
A Dockerfile gives everyone — and production — the same reproducible runtime.
Add a Dockerfile at the repository root. Use a multi-stage build to keep the final image small.
Full guide: why it matters and how to fix it →
Why this result
Searched the whole tree for Dockerfile, Dockerfile.* and *.Dockerfile (outside tests and examples) — none found.
This is a false positive
Linter or formatter configuredinfo
A single enforced code style removes a whole class of review comments.
Add a linter config: ruff.toml or pyproject.toml for Python, eslint.config.js for JavaScript, .golangci.yml for Go.
Full guide: why it matters and how to fix it →
This is a false positive
Observability tooling is wired ininfo
No monitoring library found. Without one, you learn about incidents from your users.
Add the three signals:
• Errors: sentry-sdk
• Metrics: prometheus-client plus a /metrics endpoint
• Traces: opentelemetry-sdk
• Logs: structlog or loguru for structured JSON output
Full guide: why it matters and how to fix it →
This is a false positive
Your own repositories, including the private ones
Connect GitHub or GitLab to audit private repositories, track the score over time, get an AI analysis of each issue, and open a fix as a pull request.
Create a free account →Get this report by email
The full report for octocat/Hello-World, sent to you now. Confirm the link in it and we will tell you whenever the score changes — no account, one click to stop.
One email now. Nothing else unless you confirm, and every message carries an unsubscribe link.
Badge for the README
Let us open the pull request →
Free account, connect GitHub, and the badge arrives as a reviewable pull request. Nothing is pushed to your default branch.
Passed 2
No secrets committed to the repository
.env file is not committed
Repository hygiene — not in the score 10
.gitignore configured
Add a .gitignore for your stack — gitignore.io generates one from a language list.
CHANGELOG maintained
Add CHANGELOG.md and follow the keepachangelog.com format.
CODEOWNERS is configured
Create .github/CODEOWNERS:
* @team-lead
/config/ @security-team
CONTRIBUTING guide
Add CONTRIBUTING.md describing the flow: fork, branch, pull request, review.
License specified
Add a LICENSE file — MIT or Apache 2.0 for open source, or a proprietary notice for closed code.
Pull request / issue templates
Add .github/pull_request_template.md and .github/ISSUE_TEMPLATE/bug_report.md.
README explains how to run the project
Expand the README with a Getting started section: prerequisites, install command, how to run the app, how to run the tests.
Repository is actively maintained
Either bring the project up to date or archive it so nobody depends on it by mistake.
Security policy (SECURITY.md)
Add SECURITY.md with a contact address and your expected response time.
README exists
Does not apply here 14
This project does not use a .env file.
.env is ignored by git
.dockerignore configured
No Dockerfile, so there is no build context to trim.
Healthcheck defined
No Dockerfile or compose file to define a healthcheck in.
Container runs as a non-root user
No Dockerfile, so there is no container user to set.
Base image is pinned (not :latest)
No Dockerfile, so there is no base image to pin.
Dockerfile uses a multi-stage build
No Dockerfile to build in stages.
Resource limits set in compose
No compose file to set resource limits in.
Lock file present
No dependency manifest, so there is nothing to lock.
Dependencies pinned to exact versions
No requirements.txt to check for exact versions.
.env.example documents required variables
No credentials in MCP server configs
The repository has no MCP server configs.
MCP servers run a pinned version
The repository has no MCP server configs.
AI agents in CI cannot be steered by outsiders
No workflow runs an AI agent.
Agent instruction files hold no secrets or internal addresses
The repository has no agent instruction files.