Free scanner / pallets
pallets/flask
The Python micro framework for building web applications.
67
/ 100
Good
ops
92
deps
100
docs
86
ci_cd
54
docker
63
security
48
Issues
1 critical · 7 warnings
.env is ignored by gitcrit
A .env file holding secrets must never be committed to the repository.
Add a `.env` line to .gitignore, then confirm the file is not already tracked with `git ls-files .env`. If it is, remove it from history and rotate every value in it.
Automated dependency updateswarn
Dependabot or Renovate opens pull requests as soon as a security patch is released.
Add .github/dependabot.yml so security patches arrive as pull requests instead of waiting for someone to notice them.
CODEOWNERS is configuredwarn
CODEOWNERS automatically requests review from the right people on security-critical paths.
Create .github/CODEOWNERS:
* @team-lead
/config/ @security-team
Tests run in CIwarn
Running the test suite on every commit is what stops a regression from reaching production.
Add a test step to the pipeline (pytest, jest, go test — whatever your stack uses).
Security scanning in the pipelinewarn
A scanner in CI catches vulnerable dependencies and leaked secrets before they merge.
Add a scanning step to CI. Free options: Trivy for images and dependencies, gitleaks for secrets, CodeQL for code. Each is a single job in your existing workflow.
Dockerfile presentwarn
A Dockerfile gives everyone — and production — the same reproducible runtime.
Add a Dockerfile at the repository root. Use a multi-stage build to keep the final image small.
Container runs as a non-root userwarn
A container running as root turns a process escape into host access.
Add to the Dockerfile:
RUN addgroup -S app && adduser -S app -G app
USER app
Workflow permissions are least-privilegewarn
A workflow grants broad write permissions. If any action in it is compromised, the attacker can write to the repository.
Declare the minimum each job needs:
permissions:
contents: read
pull-requests: write # only where it is actually used
Security policy (SECURITY.md)info
Tells researchers how to report a vulnerability privately instead of opening a public issue.
Add SECURITY.md with a contact address and your expected response time.
.dockerignore configuredinfo
.dockerignore keeps .git, node_modules and secrets out of the build context.
Create .dockerignore with at least: .git, node_modules, __pycache__, .env, *.log
CONTRIBUTING guideinfo
A contribution guide lowers the barrier for the next person who wants to help.
Add CONTRIBUTING.md describing the flow: fork, branch, pull request, review.
Observability tooling is wired ininfo
No monitoring library found. Without one, you learn about incidents from your users.
Add the three signals:
• Errors: sentry-sdk
• Metrics: prometheus-client plus a /metrics endpoint
• Traces: opentelemetry-sdk
• Logs: structlog or loguru for structured JSON output
Your own repositories, including the private ones
Connect GitHub or GitLab to audit private repositories, track the score over time, get an AI analysis of each issue, and open a fix as a pull request.
Create a free account →Badge for the README
Passed 21
No secrets committed to the repository
.env file is not committed
CI/CD pipeline configured
Default branch is protected
Linter or formatter configured
Healthcheck defined
Base image is pinned (not :latest)
Dockerfile uses a multi-stage build
Resource limits set in compose
README exists
README explains how to run the project
CHANGELOG maintained
Pull request / issue templates
Dependency manifest present
Lock file present
Dependencies pinned to exact versions
.gitignore configured
.env.example documents required variables
License specified
Repository is actively maintained
GitHub Actions pinned to a commit SHA