Free scanner / spring-projects
spring-projects/spring-boot
Spring Boot helps you to create Spring-powered, production-grade applications and services with absolute minimum fuss.
69
/ 100
Good
ops
92
deps
75
docs
14
ci_cd
69
docker
63
security
75
Issues
0 critical · 7 warnings
CODEOWNERS is configuredwarn
CODEOWNERS automatically requests review from the right people on security-critical paths.
Create .github/CODEOWNERS:
* @team-lead
/config/ @security-team
Tests run in CIwarn
Running the test suite on every commit is what stops a regression from reaching production.
Add a test step to the pipeline (pytest, jest, go test — whatever your stack uses).
Dockerfile presentwarn
A Dockerfile gives everyone — and production — the same reproducible runtime.
Add a Dockerfile at the repository root. Use a multi-stage build to keep the final image small.
Container runs as a non-root userwarn
A container running as root turns a process escape into host access.
Add to the Dockerfile:
RUN addgroup -S app && adduser -S app -G app
USER app
README explains how to run the projectwarn
A README without setup instructions costs every new developer their first day.
Expand the README with a Getting started section: prerequisites, install command, how to run the app, how to run the tests.
Lock file presentwarn
A lock file pins exact versions so the build you tested is the build you ship.
Generate a lock file: `pip freeze > requirements.lock`, `npm install`, `poetry lock`, `go mod tidy` or `cargo build` depending on your stack.
GitHub Actions pinned to a commit SHAwarn
2 action(s) are referenced by a moving tag, for example actions/upload-artifact@v7. A tag can be repointed at malicious code without any change on your side.
Reference actions by full commit SHA:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Tools such as pin-github-action or Dependabot can do this and keep it updated.
Security policy (SECURITY.md)info
Tells researchers how to report a vulnerability privately instead of opening a public issue.
Add SECURITY.md with a contact address and your expected response time.
Linter or formatter configuredinfo
A single enforced code style removes a whole class of review comments.
Add a linter config: ruff.toml or pyproject.toml for Python, eslint.config.js for JavaScript, .golangci.yml for Go.
.dockerignore configuredinfo
.dockerignore keeps .git, node_modules and secrets out of the build context.
Create .dockerignore with at least: .git, node_modules, __pycache__, .env, *.log
README existsinfo
The README is the first thing anyone opening the repository reads.
Add README.md covering what the project does, how to run it locally, and how to run the tests.
CHANGELOG maintainedinfo
A changelog tells users and your own team what actually changed between releases.
Add CHANGELOG.md and follow the keepachangelog.com format.
CONTRIBUTING guideinfo
A contribution guide lowers the barrier for the next person who wants to help.
Add CONTRIBUTING.md describing the flow: fork, branch, pull request, review.
Observability tooling is wired ininfo
No monitoring library found. Without one, you learn about incidents from your users.
Add the three signals:
• Errors: sentry-sdk
• Metrics: prometheus-client plus a /metrics endpoint
• Traces: opentelemetry-sdk
• Logs: structlog or loguru for structured JSON output
Your own repositories, including the private ones
Connect GitHub or GitLab to audit private repositories, track the score over time, get an AI analysis of each issue, and open a fix as a pull request.
Create a free account →Badge for the README
Passed 18
No secrets committed to the repository
.env file is not committed
.env is ignored by git
Automated dependency updates
CI/CD pipeline configured
Default branch is protected
Security scanning in the pipeline
Healthcheck defined
Base image is pinned (not :latest)
Dockerfile uses a multi-stage build
Resource limits set in compose
Pull request / issue templates
Dependency manifest present
Dependencies pinned to exact versions
.gitignore configured
.env.example documents required variables
License specified
Repository is actively maintained