{"id":377920,"url":"https://github.com/jshttp/vary","last_synced_at":"2026-09-10T22:05:03.383Z","repository":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":0,"forks_count":14,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-08-27T00:54:07.848Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36997632,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-31T02:00:07.497Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"owner":{"login":"jshttp","name":"jshttp","uuid":"8325802","kind":"organization","description":"Low-Level JavaScript HTTP-related Modules","email":null,"website":"https://expressjs.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/8325802?v=4","repositories_count":29,"last_synced_at":"2026-09-06T00:53:35.088Z","metadata":{"has_sponsors_listing":false,"funding":{"open_collective":"express"}},"html_url":"https://github.com/jshttp","funding_links":["https://opencollective.com/express"],"total_stars":10141,"followers":240,"following":0,"created_at":"2022-11-02T16:18:51.300Z","updated_at":"2026-09-06T00:53:35.115Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp/repositories"},"packages":[{"id":13744923,"name":"node-vary","ecosystem":"ubuntu","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["universe/misc"],"namespace":"universe","versions_count":1,"first_release_published_at":"2026-02-13T05:50:23.029Z","latest_release_published_at":"2026-02-13T05:50:23.029Z","latest_release_number":"1.1.2-2","last_synced_at":"2026-03-13T10:19:24.414Z","created_at":"2026-02-13T05:50:22.850Z","updated_at":"2026-08-20T06:13:51.987Z","registry_url":"https://launchpad.net/ubuntu/+source/node-vary","install_command":"apt-get install node-vary","documentation_url":null,"metadata":{"component":"universe","architecture":"all","priority":"extra","binary":"node-vary","standards_version":"4.4.1","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 12), mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e, pkg-js-tools (\u003e= 0.9.20~)","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T06:13:51.987Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/ubuntu/node-vary?arch=source\u0026distro=ubuntu-20.04\u0026repository_url=https://launchpad.net/ubuntu/focal","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/ubuntu/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/ubuntu/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/ubuntu/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"ubuntu-20.04","url":"https://launchpad.net/ubuntu/focal","ecosystem":"ubuntu","default":false,"packages_count":30789,"maintainers_count":0,"namespaces_count":4,"keywords_count":1425,"github":"ubuntu","metadata":{"codename":"focal","funded_packages_count":868},"icon_url":"https://github.com/ubuntu.png","created_at":"2026-02-04T11:01:47.233Z","updated_at":"2026-09-10T05:05:58.388Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-20.04/namespaces"}},{"id":14459253,"name":"github.com/jshttp/vary","ecosystem":"go","description":null,"homepage":null,"licenses":"mit","normalized_licenses":["MIT"],"repository_url":"https://github.com/jshttp/vary","keywords_array":[],"namespace":null,"versions_count":7,"first_release_published_at":"2014-06-04T20:53:01.000Z","latest_release_published_at":"2017-09-24T01:45:17.000Z","latest_release_number":"v1.1.2","last_synced_at":"2026-09-09T21:49:13.337Z","created_at":"2026-05-16T14:35:59.892Z","updated_at":"2026-09-09T21:49:13.338Z","registry_url":"https://pkg.go.dev/github.com/jshttp/vary","install_command":"go get github.com/jshttp/vary","documentation_url":"https://pkg.go.dev/github.com/jshttp/vary#section-documentation","metadata":{},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T01:08:40.908Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":5.059532431414583,"dependent_packages_count":4.740914073502298,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":4.90022325245844},"purl":"pkg:golang/github.com/jshttp/vary","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/jshttp/vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/jshttp/vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/jshttp/vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-19T00:51:34.064Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fjshttp%2Fvary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fjshttp%2Fvary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fjshttp%2Fvary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fjshttp%2Fvary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fjshttp%2Fvary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fjshttp%2Fvary/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2307136,"maintainers_count":0,"namespaces_count":840653,"keywords_count":127325,"github":"golang","metadata":{"funded_packages_count":79022,"sync_missing_packages_cursor":{"timestamp":"2026-09-10T00:02:38.001811Z","path":"github.com/tm-acode/dependabot_core","version":"v0.27.11"},"rate_limit":1},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-09-10T05:04:23.547Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":13460204,"name":"node-vary","ecosystem":"ubuntu","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["universe/misc"],"namespace":"universe","versions_count":1,"first_release_published_at":"2026-02-09T07:31:37.186Z","latest_release_published_at":"2026-02-09T07:31:37.186Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-08-31T20:30:15.136Z","created_at":"2026-02-09T07:31:35.707Z","updated_at":"2026-08-31T20:30:15.136Z","registry_url":"https://launchpad.net/ubuntu/+source/node-vary","install_command":"apt-get install node-vary","documentation_url":null,"metadata":{"component":"universe","architecture":"all","priority":"extra","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T04:29:58.005Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/ubuntu/node-vary?arch=source\u0026distro=ubuntu-24.10\u0026repository_url=https://launchpad.net/ubuntu/oracular","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/ubuntu/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/ubuntu/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/ubuntu/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"ubuntu-24.10","url":"https://launchpad.net/ubuntu/oracular","ecosystem":"ubuntu","default":false,"packages_count":38437,"maintainers_count":0,"namespaces_count":4,"keywords_count":1440,"github":"ubuntu","metadata":{"codename":"oracular","mirror":"http://old-releases.ubuntu.com/ubuntu","funded_packages_count":1557},"icon_url":"https://github.com/ubuntu.png","created_at":"2026-02-04T11:01:48.028Z","updated_at":"2026-09-10T05:05:25.290Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.10/namespaces"}},{"id":2518341,"name":"vary","ecosystem":"npm","description":"Manipulate the HTTP Vary header","homepage":"https://github.com/jshttp/vary#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/jshttp/vary","keywords_array":["http","res","vary"],"namespace":null,"versions_count":7,"first_release_published_at":"2014-06-04T20:52:53.541Z","latest_release_published_at":"2017-09-24T01:47:11.325Z","latest_release_number":"1.1.2","last_synced_at":"2026-09-09T01:13:45.492Z","created_at":"2022-04-10T02:55:48.206Z","updated_at":"2026-09-10T12:45:40.875Z","registry_url":"https://www.npmjs.com/package/vary","install_command":"npm install vary","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"1.1.2"},"contentPolicy":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":0,"forks_count":14,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-08-27T00:54:07.848Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36997632,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-31T02:00:07.497Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"jshttp","name":"jshttp","uuid":"8325802","kind":"organization","description":"Low-Level JavaScript HTTP-related Modules","email":null,"website":"https://expressjs.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/8325802?v=4","repositories_count":29,"last_synced_at":"2026-09-06T00:53:35.088Z","metadata":{"has_sponsors_listing":false,"funding":{"open_collective":"express"}},"html_url":"https://github.com/jshttp","funding_links":["https://opencollective.com/express"],"total_stars":10141,"followers":240,"following":0,"created_at":"2022-11-02T16:18:51.300Z","updated_at":"2026-09-06T00:53:35.115Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp/repositories"},"tags":[{"name":"v1.1.2","sha":"4067e646233fbc8ec9e7a9cd78d6f063c6fdc17e","kind":"commit","published_at":"2017-09-24T01:45:17.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.2","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"ca7edac6b919a45bf9e2c5cb6ba31c1790e9f046","kind":"commit","published_at":"2017-03-20T21:25:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"13b03e9bf97da9d83bfeac84d84144137d84c257","kind":"commit","published_at":"2015-09-30T05:04:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0/manifests"},{"name":"v1.0.1","sha":"650282ff8e614731837040a23e10f51c20728392","kind":"commit","published_at":"2015-07-09T00:00:58.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"56acecd9fa20888132563b00576625ea02a69a35","kind":"commit","published_at":"2014-08-10T21:02:45.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0/manifests"},{"name":"v0.1.0","sha":"a1c2e035c559ff1c28a507d9603f8adc25fa2b17","kind":"commit","published_at":"2014-06-05T13:18:05.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0/manifests"},{"name":"v0.0.0","sha":"9efe5fef336d91c4680328574645d760ca315580","kind":"commit","published_at":"2014-06-04T20:53:01.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0/manifests"}]},"repo_metadata_updated_at":"2026-09-10T12:45:40.875Z","dependent_packages_count":1385,"downloads":429299035,"downloads_period":"last-month","dependent_repos_count":4406042,"rankings":{"downloads":0.010568613299367745,"dependent_repos_count":0.0008761544704139063,"dependent_packages_count":0.052706167360836546,"stargazers_count":5.754529377604336,"forks_count":5.974827527576285,"docker_downloads_count":0.013443495155413375,"average":1.9678252225777755},"purl":"pkg:npm/vary","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/vary","docker_dependents_count":48394,"docker_downloads_count":7164982054,"usage_url":"https://repos.ecosyste.ms/usage/npm/vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":true,"issue_metadata":{"last_synced_at":"2026-09-09T21:35:14.434Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":10,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4389569.222222222,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":9,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.2,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":7,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/vary/codemeta","maintainers":[{"uuid":"dougwilson","login":"dougwilson","name":null,"email":"doug@somethingdoug.com","url":null,"packages_count":102,"html_url":"https://www.npmjs.com/~dougwilson","role":null,"created_at":"2022-11-15T06:38:53.886Z","updated_at":"2022-11-15T06:38:53.886Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/dougwilson/packages"},{"uuid":"blakeembrey","login":"blakeembrey","name":null,"email":"hello@blakeembrey.com","url":null,"packages_count":241,"html_url":"https://www.npmjs.com/~blakeembrey","role":null,"created_at":"2024-10-30T16:37:58.789Z","updated_at":"2024-10-30T16:37:58.789Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/blakeembrey/packages"},{"uuid":"ulisesgascon","login":"ulisesgascon","name":null,"email":"ulisesgascondev@gmail.com","url":null,"packages_count":224,"html_url":"https://www.npmjs.com/~ulisesgascon","role":null,"created_at":"2025-05-14T16:37:59.978Z","updated_at":"2025-05-14T16:37:59.978Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/ulisesgascon/packages"}],"registry":{"name":"npmjs.org","url":"https://registry.npmjs.org","ecosystem":"npm","default":true,"packages_count":5845076,"maintainers_count":1251355,"namespaces_count":430813,"keywords_count":896120,"github":"npm","metadata":{"funded_packages_count":194004,"rate_limit":2},"icon_url":"https://github.com/npm.png","created_at":"2022-04-04T15:19:23.081Z","updated_at":"2026-09-10T05:03:06.062Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/namespaces"}},{"id":5007137,"name":"org.webjars.npm:vary","ecosystem":"maven","description":"WebJar for vary","homepage":"http://webjars.org","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/jshttp/vary","keywords_array":[],"namespace":"org.webjars.npm","versions_count":5,"first_release_published_at":"2015-08-25T20:07:07.000Z","latest_release_published_at":"2018-03-06T12:06:56.000Z","latest_release_number":"1.1.2","last_synced_at":"2026-09-09T01:22:36.410Z","created_at":"2022-07-27T11:13:57.933Z","updated_at":"2026-09-09T01:22:36.410Z","registry_url":"https://central.sonatype.com/artifact/org.webjars.npm/vary/","install_command":null,"documentation_url":"https://appdoc.app/artifact/org.webjars.npm/vary/","metadata":{"repositories":["https://repo.maven.apache.org/maven2"]},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"jshttp","name":"jshttp","uuid":"8325802","kind":"organization","description":"Low-Level JavaScript HTTP-related Modules","email":null,"website":"https://expressjs.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/8325802?v=4","repositories_count":29,"last_synced_at":"2026-08-14T04:49:58.575Z","metadata":{"has_sponsors_listing":false,"funding":{"open_collective":"express"}},"html_url":"https://github.com/jshttp","funding_links":["https://opencollective.com/express"],"total_stars":10129,"followers":239,"following":0,"created_at":"2022-11-02T16:18:51.300Z","updated_at":"2026-08-14T04:49:58.627Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp/repositories"},"tags":[{"name":"v1.1.2","sha":"4067e646233fbc8ec9e7a9cd78d6f063c6fdc17e","kind":"commit","published_at":"2017-09-24T01:45:17.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.2","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"ca7edac6b919a45bf9e2c5cb6ba31c1790e9f046","kind":"commit","published_at":"2017-03-20T21:25:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"13b03e9bf97da9d83bfeac84d84144137d84c257","kind":"commit","published_at":"2015-09-30T05:04:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0/manifests"},{"name":"v1.0.1","sha":"650282ff8e614731837040a23e10f51c20728392","kind":"commit","published_at":"2015-07-09T00:00:58.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"56acecd9fa20888132563b00576625ea02a69a35","kind":"commit","published_at":"2014-08-10T21:02:45.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0/manifests"},{"name":"v0.1.0","sha":"a1c2e035c559ff1c28a507d9603f8adc25fa2b17","kind":"commit","published_at":"2014-06-05T13:18:05.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0/manifests"},{"name":"v0.0.0","sha":"9efe5fef336d91c4680328574645d760ca315580","kind":"commit","published_at":"2014-06-04T20:53:01.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0/manifests"}]},"repo_metadata_updated_at":"2026-08-20T04:38:58.711Z","dependent_packages_count":7,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":31.979943940947386,"dependent_packages_count":8.051315902994164,"stargazers_count":null,"forks_count":null,"average":20.015629921970774},"purl":"pkg:maven/org.webjars.npm/vary","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/maven/org.webjars.npm:vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/maven/org.webjars.npm:vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/maven/org.webjars.npm:vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.npm:vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.npm:vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.npm:vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.npm:vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.npm:vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.npm:vary/codemeta","maintainers":[],"registry":{"name":"repo1.maven.org","url":"https://maven-central.storage-download.googleapis.com/maven2","ecosystem":"maven","default":true,"packages_count":622688,"maintainers_count":0,"namespaces_count":82667,"keywords_count":37216,"github":"maven-central","metadata":{"funded_packages_count":50888,"rate_limit":2},"icon_url":"https://github.com/maven-central.png","created_at":"2022-07-21T16:40:13.074Z","updated_at":"2026-09-10T05:01:15.859Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/namespaces"}},{"id":13523670,"name":"node-vary","ecosystem":"debian","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["javascript"],"namespace":"main","versions_count":1,"first_release_published_at":"2026-02-10T22:12:23.130Z","latest_release_published_at":"2026-02-10T22:12:23.130Z","latest_release_number":"1.1.2-2","last_synced_at":"2026-07-30T13:09:28.315Z","created_at":"2026-02-10T22:12:22.750Z","updated_at":"2026-08-20T02:02:22.239Z","registry_url":"https://tracker.debian.org/pkg/node-vary","install_command":"apt-get install node-vary","documentation_url":"https://packages.debian.org/bullseye/node-vary","metadata":{"component":"main","architecture":"all","priority":"optional","binary":"node-vary","standards_version":"4.4.1","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 12), mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e, pkg-js-tools (\u003e= 0.9.20~)","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T02:02:22.239Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/debian/node-vary?arch=source\u0026distro=debian-11\u0026repository_url=https://packages.debian.org/bullseye","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/debian/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/debian/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/debian/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-19T00:51:34.064Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"debian-11","url":"https://packages.debian.org/bullseye","ecosystem":"debian","default":false,"packages_count":31268,"maintainers_count":0,"namespaces_count":3,"keywords_count":759,"github":"debian","metadata":{"codename":"bullseye","funded_packages_count":941},"icon_url":"https://github.com/debian.png","created_at":"2026-02-04T11:01:49.702Z","updated_at":"2026-09-10T05:05:50.632Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/debian-11/namespaces"}},{"id":13559156,"name":"node-vary","ecosystem":"ubuntu","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["universe/misc"],"namespace":"universe","versions_count":1,"first_release_published_at":"2026-02-11T04:56:12.765Z","latest_release_published_at":"2026-02-11T04:56:12.765Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-03-11T11:05:24.614Z","created_at":"2026-02-11T04:56:12.576Z","updated_at":"2026-08-20T02:08:03.732Z","registry_url":"https://launchpad.net/ubuntu/+source/node-vary","install_command":"apt-get install node-vary","documentation_url":null,"metadata":{"component":"universe","architecture":"all","priority":"extra","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T02:08:03.732Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/ubuntu/node-vary?arch=source\u0026distro=ubuntu-23.04\u0026repository_url=https://launchpad.net/ubuntu/lunar","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/ubuntu/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/ubuntu/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/ubuntu/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-19T00:51:34.064Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"ubuntu-23.04","url":"https://launchpad.net/ubuntu/lunar","ecosystem":"ubuntu","default":false,"packages_count":36116,"maintainers_count":0,"namespaces_count":4,"keywords_count":999,"github":"ubuntu","metadata":{"codename":"lunar","mirror":"http://old-releases.ubuntu.com/ubuntu","funded_packages_count":1301},"icon_url":"https://github.com/ubuntu.png","created_at":"2026-02-04T11:01:49.117Z","updated_at":"2026-09-10T05:05:57.112Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.04/namespaces"}},{"id":13429269,"name":"node-vary","ecosystem":"ubuntu","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["universe/misc"],"namespace":"universe","versions_count":1,"first_release_published_at":"2026-02-07T16:30:52.670Z","latest_release_published_at":"2026-02-07T16:30:52.670Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-03-07T17:33:25.677Z","created_at":"2026-02-07T16:30:52.385Z","updated_at":"2026-08-20T02:57:01.212Z","registry_url":"https://launchpad.net/ubuntu/+source/node-vary","install_command":"apt-get install node-vary","documentation_url":null,"metadata":{"component":"universe","architecture":"all","priority":"extra","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T02:57:01.212Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/ubuntu/node-vary?arch=source\u0026distro=ubuntu-22.04\u0026repository_url=https://launchpad.net/ubuntu/jammy","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/ubuntu/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/ubuntu/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/ubuntu/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"ubuntu-22.04","url":"https://launchpad.net/ubuntu/jammy","ecosystem":"ubuntu","default":false,"packages_count":34289,"maintainers_count":0,"namespaces_count":4,"keywords_count":1498,"github":"ubuntu","metadata":{"codename":"jammy","funded_packages_count":1149},"icon_url":"https://github.com/ubuntu.png","created_at":"2026-02-04T11:01:46.486Z","updated_at":"2026-09-10T05:05:52.205Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-22.04/namespaces"}},{"id":13660425,"name":"node-vary","ecosystem":"debian","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["javascript"],"namespace":"main","versions_count":1,"first_release_published_at":"2026-02-12T08:39:07.417Z","latest_release_published_at":"2026-02-12T08:39:07.417Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-03-13T23:15:07.932Z","created_at":"2026-02-12T08:39:07.222Z","updated_at":"2026-08-20T03:28:44.988Z","registry_url":"https://tracker.debian.org/pkg/node-vary","install_command":"apt-get install node-vary","documentation_url":"https://packages.debian.org/trixie/node-vary","metadata":{"component":"main","architecture":"all","priority":"optional","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T03:28:44.988Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/debian/node-vary?arch=source\u0026distro=debian-13\u0026repository_url=https://packages.debian.org/trixie","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/debian/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/debian/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/debian/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"debian-13","url":"https://packages.debian.org/trixie","ecosystem":"debian","default":false,"packages_count":38024,"maintainers_count":0,"namespaces_count":4,"keywords_count":1985,"github":"debian","metadata":{"codename":"trixie","funded_packages_count":1942},"icon_url":"https://github.com/debian.png","created_at":"2026-02-04T11:01:50.448Z","updated_at":"2026-09-10T05:05:23.251Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/debian-13/namespaces"}},{"id":13795116,"name":"node-vary","ecosystem":"ubuntu","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["universe/misc"],"namespace":"universe","versions_count":1,"first_release_published_at":"2026-02-13T16:16:46.245Z","latest_release_published_at":"2026-02-13T16:16:46.245Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-07-31T23:00:30.627Z","created_at":"2026-02-13T16:16:46.074Z","updated_at":"2026-08-20T03:32:38.158Z","registry_url":"https://launchpad.net/ubuntu/+source/node-vary","install_command":"apt-get install node-vary","documentation_url":null,"metadata":{"component":"universe","architecture":"all","priority":"extra","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T03:32:38.157Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/ubuntu/node-vary?arch=source\u0026distro=ubuntu-23.10\u0026repository_url=https://launchpad.net/ubuntu/mantic","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/ubuntu/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/ubuntu/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/ubuntu/node-vary/dependencies","status":"removed","funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"ubuntu-23.10","url":"https://launchpad.net/ubuntu/mantic","ecosystem":"ubuntu","default":false,"packages_count":36642,"maintainers_count":0,"namespaces_count":4,"keywords_count":2211,"github":"ubuntu","metadata":{"codename":"mantic","mirror":"http://old-releases.ubuntu.com/ubuntu","funded_packages_count":1541},"icon_url":"https://github.com/ubuntu.png","created_at":"2026-02-04T11:01:48.636Z","updated_at":"2026-09-10T05:05:55.540Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-23.10/namespaces"}},{"id":13702733,"name":"node-vary","ecosystem":"debian","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["javascript"],"namespace":"main","versions_count":1,"first_release_published_at":"2026-02-12T21:27:06.030Z","latest_release_published_at":"2026-02-12T21:27:06.030Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-03-13T05:27:07.242Z","created_at":"2026-02-12T21:27:05.856Z","updated_at":"2026-08-20T04:05:58.031Z","registry_url":"https://tracker.debian.org/pkg/node-vary","install_command":"apt-get install node-vary","documentation_url":"https://packages.debian.org/bookworm/node-vary","metadata":{"component":"main","architecture":"all","priority":"optional","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T04:05:58.030Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/debian/node-vary?arch=source\u0026distro=debian-12","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/debian/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/debian/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/debian/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"debian-12","url":"https://packages.debian.org/bookworm","ecosystem":"debian","default":true,"packages_count":34734,"maintainers_count":0,"namespaces_count":4,"keywords_count":2635,"github":"debian","metadata":{"codename":"bookworm","funded_packages_count":1400},"icon_url":"https://github.com/debian.png","created_at":"2026-02-04T11:01:49.459Z","updated_at":"2026-09-10T05:05:48.174Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/debian-12/namespaces"}},{"id":13597520,"name":"node-vary","ecosystem":"debian","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["javascript"],"namespace":"main","versions_count":1,"first_release_published_at":"2026-02-11T10:32:34.265Z","latest_release_published_at":"2026-02-11T10:32:34.265Z","latest_release_number":"1.1.2-1","last_synced_at":"2026-07-29T05:03:53.918Z","created_at":"2026-02-11T10:32:34.033Z","updated_at":"2026-08-20T05:41:04.987Z","registry_url":"https://tracker.debian.org/pkg/node-vary","install_command":"apt-get install node-vary","documentation_url":"https://packages.debian.org/buster/node-vary","metadata":{"component":"main","architecture":"all","priority":"optional","binary":"node-vary","standards_version":"4.2.1","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper (\u003e= 11), dh-buildinfo, nodejs, node-should \u003c!nocheck\u003e, node-mocha \u003c!nocheck\u003e, node-supertest \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T05:41:04.986Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/debian/node-vary?arch=source\u0026distro=debian-10\u0026repository_url=https://packages.debian.org/buster","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/debian/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/debian/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/debian/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"debian-10","url":"https://packages.debian.org/buster","ecosystem":"debian","default":false,"packages_count":28836,"maintainers_count":0,"namespaces_count":3,"keywords_count":903,"github":"debian","metadata":{"codename":"buster","mirror":"http://archive.debian.org/debian","funded_packages_count":697},"icon_url":"https://github.com/debian.png","created_at":"2026-02-04T11:01:50.156Z","updated_at":"2026-09-10T05:00:31.238Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/debian-10/namespaces"}},{"id":13400202,"name":"node-vary","ecosystem":"ubuntu","description":null,"homepage":"https://github.com/jshttp/vary","licenses":"mit","normalized_licenses":[],"repository_url":"https://github.com/jshttp/vary","keywords_array":["universe/misc"],"namespace":"universe","versions_count":1,"first_release_published_at":"2026-02-06T06:46:31.389Z","latest_release_published_at":"2026-02-06T06:46:31.389Z","latest_release_number":"1.1.2+~1.1.0-1","last_synced_at":"2026-08-24T23:34:28.210Z","created_at":"2026-02-06T06:46:31.076Z","updated_at":"2026-08-24T23:34:28.210Z","registry_url":"https://launchpad.net/ubuntu/+source/node-vary","install_command":"apt-get install node-vary","documentation_url":null,"metadata":{"component":"universe","architecture":"all","priority":"extra","binary":"node-vary","standards_version":"4.6.0","maintainer":"Debian Javascript Maintainers \u003cpkg-javascript-devel@lists.alioth.debian.org\u003e","build_depends":"debhelper-compat (= 13), dh-sequence-nodejs, mocha \u003c!nocheck\u003e, node-should \u003c!nocheck\u003e, node-supertest (\u003e= 1.1.0) \u003c!nocheck\u003e","build_depends_indep":null,"build_depends_arch":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"repo_metadata_updated_at":"2026-08-20T05:11:15.897Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:deb/ubuntu/node-vary?arch=source\u0026distro=ubuntu-24.04","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/ubuntu/node-vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/ubuntu/node-vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/ubuntu/node-vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages/node-vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages/node-vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages/node-vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages/node-vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages/node-vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages/node-vary/codemeta","maintainers":[],"registry":{"name":"ubuntu-24.04","url":"https://launchpad.net/ubuntu/noble","ecosystem":"ubuntu","default":true,"packages_count":37306,"maintainers_count":0,"namespaces_count":4,"keywords_count":1697,"github":"ubuntu","metadata":{"codename":"noble","funded_packages_count":1479},"icon_url":"https://github.com/ubuntu.png","created_at":"2026-02-04T11:01:45.928Z","updated_at":"2026-09-10T05:05:53.832Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/ubuntu-24.04/namespaces"}},{"id":14075165,"name":"@depup/vary","ecosystem":"npm","description":"[DepUp] Manipulate the HTTP Vary header","homepage":"https://github.com/jshttp/vary#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/jshttp/vary","keywords_array":["depup","dependency-bumped","updated-deps","vary","http","res"],"namespace":"depup","versions_count":1,"first_release_published_at":"2026-03-17T16:39:53.648Z","latest_release_published_at":"2026-03-17T16:39:53.648Z","latest_release_number":"1.1.2-depup.0","last_synced_at":"2026-09-09T21:42:51.796Z","created_at":"2026-03-19T04:24:09.243Z","updated_at":"2026-09-09T21:42:51.796Z","registry_url":"https://www.npmjs.com/package/@depup/vary","install_command":"npm install @depup/vary","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"1.1.2-depup.0"},"contentPolicy":null},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":0,"forks_count":14,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-08-27T00:54:07.848Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36997632,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-31T02:00:07.497Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"jshttp","name":"jshttp","uuid":"8325802","kind":"organization","description":"Low-Level JavaScript HTTP-related Modules","email":null,"website":"https://expressjs.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/8325802?v=4","repositories_count":29,"last_synced_at":"2026-09-06T00:53:35.088Z","metadata":{"has_sponsors_listing":false,"funding":{"open_collective":"express"}},"html_url":"https://github.com/jshttp","funding_links":["https://opencollective.com/express"],"total_stars":10141,"followers":240,"following":0,"created_at":"2022-11-02T16:18:51.300Z","updated_at":"2026-09-06T00:53:35.115Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp/repositories"},"tags":[{"name":"v1.1.2","sha":"4067e646233fbc8ec9e7a9cd78d6f063c6fdc17e","kind":"commit","published_at":"2017-09-24T01:45:17.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.2","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"ca7edac6b919a45bf9e2c5cb6ba31c1790e9f046","kind":"commit","published_at":"2017-03-20T21:25:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"13b03e9bf97da9d83bfeac84d84144137d84c257","kind":"commit","published_at":"2015-09-30T05:04:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0/manifests"},{"name":"v1.0.1","sha":"650282ff8e614731837040a23e10f51c20728392","kind":"commit","published_at":"2015-07-09T00:00:58.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"56acecd9fa20888132563b00576625ea02a69a35","kind":"commit","published_at":"2014-08-10T21:02:45.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0/manifests"},{"name":"v0.1.0","sha":"a1c2e035c559ff1c28a507d9603f8adc25fa2b17","kind":"commit","published_at":"2014-06-05T13:18:05.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0/manifests"},{"name":"v0.0.0","sha":"9efe5fef336d91c4680328574645d760ca315580","kind":"commit","published_at":"2014-06-04T20:53:01.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0/manifests"}]},"repo_metadata_updated_at":"2026-09-08T23:33:19.345Z","dependent_packages_count":0,"downloads":13,"downloads_period":"last-month","dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":22.40941024303714,"dependent_packages_count":32.301555319200475,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":27.35548278111881},"purl":"pkg:npm/%40depup/vary","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/@depup/vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/npm/@depup/vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/@depup/vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-08T21:03:35.059Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":10,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4389569.222222222,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":9,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.2,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":7,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@depup%2Fvary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@depup%2Fvary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@depup%2Fvary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@depup%2Fvary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@depup%2Fvary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@depup%2Fvary/codemeta","maintainers":[{"uuid":"chiefmikey","login":"chiefmikey","name":null,"email":"wolfemikl@gmail.com","url":null,"packages_count":2150,"html_url":"https://www.npmjs.com/~chiefmikey","role":null,"created_at":"2026-03-19T04:24:14.551Z","updated_at":"2026-03-19T04:24:14.551Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/chiefmikey/packages"}],"registry":{"name":"npmjs.org","url":"https://registry.npmjs.org","ecosystem":"npm","default":true,"packages_count":5845076,"maintainers_count":1251355,"namespaces_count":430813,"keywords_count":896120,"github":"npm","metadata":{"funded_packages_count":194004,"rate_limit":2},"icon_url":"https://github.com/npm.png","created_at":"2022-04-04T15:19:23.081Z","updated_at":"2026-09-10T05:03:06.062Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/namespaces"}},{"id":4991594,"name":"org.webjars.bowergithub.jshttp:vary","ecosystem":"maven","description":"WebJar for vary","homepage":"http://webjars.org","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/jshttp/vary","keywords_array":[],"namespace":"org.webjars.bowergithub.jshttp","versions_count":1,"first_release_published_at":"2018-08-29T18:01:35.000Z","latest_release_published_at":"2018-08-29T18:01:35.000Z","latest_release_number":"1.1.2","last_synced_at":"2026-09-09T01:19:05.985Z","created_at":"2022-07-27T10:38:10.306Z","updated_at":"2026-09-09T01:19:05.985Z","registry_url":"https://central.sonatype.com/artifact/org.webjars.bowergithub.jshttp/vary/","install_command":null,"documentation_url":"https://appdoc.app/artifact/org.webjars.bowergithub.jshttp/vary/","metadata":{"repositories":["https://repo.maven.apache.org/maven2"]},"repo_metadata":{"id":17692712,"uuid":"20498698","full_name":"jshttp/vary","owner":"jshttp","description":"Manipulate the HTTP Vary header","archived":false,"fork":false,"pushed_at":"2026-04-02T16:30:02.000Z","size":124,"stargazers_count":65,"open_issues_count":2,"forks_count":16,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-07-21T09:27:16.329Z","etag":null,"topics":["http","javascript","nodejs","vary"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jshttp.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"express"}},"created_at":"2014-06-04T20:21:26.000Z","updated_at":"2026-05-02T22:46:35.000Z","dependencies_parsed_at":"2026-03-10T09:00:03.073Z","dependency_job_id":null,"html_url":"https://github.com/jshttp/vary","commit_stats":{"total_commits":216,"total_committers":2,"mean_commits":108.0,"dds":0.00462962962962965,"last_synced_commit":"5d725d059b3871025cf753e9dfa08924d0bcfa8f"},"previous_names":["expressjs/vary"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/jshttp/vary","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/sbom","scorecard":{"id":388462,"data":{"date":"2024-08-12T21:25:28Z","repo":{"name":"github.com/jshttp/vary","commit":"c51f436833208dc74ef13f2b16c167d3d26cc3ed"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":3.4,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":0,"reason":"0 out of 3 merged PRs checked by a CI test -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":1,"reason":"found 27 unreviewed changesets out of 30 -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"6 different organizations found -- score normalized to 10","details":["Info: contributors work for ExpressGateway,crypto-utils,mysqljs,nodejs,repo-utils,stream-utils"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":0,"reason":"no update tool detected","details":["Warn: tool 'RenovateBot' is not used: Follow the instructions from https://docs.renovatebot.com/configuration-options/. (Low effort)","Warn: tool 'Dependabot' is not used: Follow the instructions from https://docs.github.com/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates. (Low effort)","Warn: tool 'PyUp' is not used: Follow the instructions from https://docs.pyup.io/docs. (Low effort)","Warn: tool 'Sonatype Lift' is not used: Follow the instructions from https://help.sonatype.com/lift/getting-started. (Low effort)"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project.\nOver time, try to add fuzzing for more functionalities of your project. (Medium effort)","Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI.\nOver time, try to add fuzzing for more functionalities of your project. (High effort)","Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project:\nQuickCheck: https://hackage.haskell.org/package/QuickCheck\nhedgehog: https://hedgehog.qa/\nvalidity: https://github.com/NorfairKing/validity\nsmallcheck: https://hackage.haskell.org/package/smallcheck\nhspec: https://hspec.github.io/\ntasty: https://hackage.haskell.org/package/tasty (High effort)","Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)","Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"0 commit(s) out of 30 and 0 issue activity out of 4 found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"no published package detected","details":["Warn: no GitHub/GitLab publishing workflow detected"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:242: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:190","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:206","Info:   3 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   3 third-party GitHubAction dependencies pinned","Info:   0 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 3 are checked with a SAST tool","Warn: CodeQL tool not detected"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md.\nFor additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nProvide a point of contact in your SECURITY.md.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)","Warn: no security file to analyze: On GitHub:\nEnable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository\nAdd a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities.\nOn GitLab:\nAdd a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project.\nExamples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":["Warn: no GitHub releases found"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1: Visit https://app.stepsecurity.io/secureworkflow/jshttp/vary/ci.yml/master?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:19","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"no vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:14:34.111Z","repository_id":17692712,"created_at":"2025-08-18T17:14:34.111Z","updated_at":"2025-08-18T17:14:34.111Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35976727,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-28T02:00:06.341Z","response_time":109,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"jshttp","name":"jshttp","uuid":"8325802","kind":"organization","description":"Low-Level JavaScript HTTP-related Modules","email":null,"website":"https://expressjs.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/8325802?v=4","repositories_count":29,"last_synced_at":"2026-08-14T04:49:58.575Z","metadata":{"has_sponsors_listing":false,"funding":{"open_collective":"express"}},"html_url":"https://github.com/jshttp","funding_links":["https://opencollective.com/express"],"total_stars":10129,"followers":239,"following":0,"created_at":"2022-11-02T16:18:51.300Z","updated_at":"2026-08-14T04:49:58.627Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jshttp/repositories"},"tags":[{"name":"v1.1.2","sha":"4067e646233fbc8ec9e7a9cd78d6f063c6fdc17e","kind":"commit","published_at":"2017-09-24T01:45:17.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.2","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"ca7edac6b919a45bf9e2c5cb6ba31c1790e9f046","kind":"commit","published_at":"2017-03-20T21:25:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"13b03e9bf97da9d83bfeac84d84144137d84c257","kind":"commit","published_at":"2015-09-30T05:04:11.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.1.0/manifests"},{"name":"v1.0.1","sha":"650282ff8e614731837040a23e10f51c20728392","kind":"commit","published_at":"2015-07-09T00:00:58.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.1","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"56acecd9fa20888132563b00576625ea02a69a35","kind":"commit","published_at":"2014-08-10T21:02:45.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v1.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v1.0.0/manifests"},{"name":"v0.1.0","sha":"a1c2e035c559ff1c28a507d9603f8adc25fa2b17","kind":"commit","published_at":"2014-06-05T13:18:05.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.1.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.1.0/manifests"},{"name":"v0.0.0","sha":"9efe5fef336d91c4680328574645d760ca315580","kind":"commit","published_at":"2014-06-04T20:53:01.000Z","download_url":"https://codeload.github.com/jshttp/vary/tar.gz/v0.0.0","html_url":"https://github.com/jshttp/vary/releases/tag/v0.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/jshttp/vary@v0.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/tags/v0.0.0/manifests"}]},"repo_metadata_updated_at":"2026-08-20T05:22:53.359Z","dependent_packages_count":0,"downloads":null,"downloads_period":null,"dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":31.979943940947386,"dependent_packages_count":48.85985838769028,"stargazers_count":21.974386189489227,"forks_count":26.21693689644725,"average":32.25778135364354},"purl":"pkg:maven/org.webjars.bowergithub.jshttp/vary","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/maven/org.webjars.bowergithub.jshttp:vary","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/maven/org.webjars.bowergithub.jshttp:vary","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/maven/org.webjars.bowergithub.jshttp:vary/dependencies","status":null,"funding_links":["https://opencollective.com/express"],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-20T01:08:41.114Z","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":13,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4538130.545454546,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":11,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.3076923076923077,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":5,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","maintainers":[{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"},{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"},{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}],"active_maintainers":[{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"},{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.bowergithub.jshttp:vary/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.bowergithub.jshttp:vary/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.bowergithub.jshttp:vary/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.bowergithub.jshttp:vary/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.bowergithub.jshttp:vary/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages/org.webjars.bowergithub.jshttp:vary/codemeta","maintainers":[],"registry":{"name":"repo1.maven.org","url":"https://maven-central.storage-download.googleapis.com/maven2","ecosystem":"maven","default":true,"packages_count":622688,"maintainers_count":0,"namespaces_count":82667,"keywords_count":37216,"github":"maven-central","metadata":{"funded_packages_count":50888,"rate_limit":2},"icon_url":"https://github.com/maven-central.png","created_at":"2022-07-21T16:40:13.074Z","updated_at":"2026-09-10T05:01:15.859Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/repo1.maven.org/namespaces"}}],"commits":{"id":379548,"full_name":"jshttp/vary","default_branch":"master","total_commits":231,"total_committers":8,"total_bot_commits":8,"total_bot_committers":1,"mean_commits":28.875,"dds":0.06926406926406925,"past_year_total_commits":9,"past_year_total_committers":2,"past_year_total_bot_commits":8,"past_year_total_bot_committers":1,"past_year_mean_commits":4.5,"past_year_dds":0.11111111111111116,"last_synced_at":"2026-09-09T21:35:12.967Z","last_synced_commit":"1220b9c487f9538a6dd509ef11b6a5042d85bd05","created_at":"2023-03-08T20:00:54.768Z","updated_at":"2026-09-09T21:35:12.818Z","committers":[{"name":"Douglas Christopher Wilson","email":"doug@somethingdoug.com","login":"dougwilson","count":215},{"name":"dependabot[bot]","email":"49699333+dependabot[bot]","login":"dependabot[bot]","count":8},{"name":"Íñigo Marquínez Prado","email":"25435858+inigomarquinez","login":"inigomarquinez","count":2},{"name":"Ulises Gascón","email":"ulisesgascongonzalez@gmail.com","login":"UlisesGascon","count":2},{"name":"Rakesh Bisht","email":"raks.bisht@gmail.com","login":"raksbisht","count":1},{"name":"Phillip Barta","email":"barta.phillip@gmail.com","login":"Phillip9587","count":1},{"name":"Nook Scheel","email":"nook@live.ru","login":"nook-scheel","count":1},{"name":"Blake Embrey","email":"hello@blakeembrey.com","login":"blakeembrey","count":1}],"past_year_committers":[{"name":"dependabot[bot]","email":"49699333+dependabot[bot]","login":"dependabot[bot]","count":8},{"name":"Blake Embrey","email":"hello@blakeembrey.com","login":"blakeembrey","count":1}],"commits_url":"https://commits.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/commits","host":{"name":"GitHub","url":"https://github.com","kind":"github","last_synced_at":"2026-09-10T00:00:07.690Z","repositories_count":7191421,"commits_count":1071921433,"contributors_count":47171009,"owners_count":1437059,"committers_count":3482832,"icon_url":"https://github.com/github.png","host_url":"https://commits.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://commits.ecosyste.ms/api/v1/hosts/GitHub/repositories"}},"issues":{"table":{"full_name":"jshttp/vary","html_url":"https://github.com/jshttp/vary","last_synced_at":"2026-09-09T21:35:14.434Z","status":"error","issues_count":4,"pull_requests_count":38,"avg_time_to_close_issue":269027.0,"avg_time_to_close_pull_request":7230306.4,"issues_closed_count":4,"pull_requests_closed_count":25,"pull_request_authors_count":8,"issue_authors_count":3,"avg_comments_per_issue":5.25,"avg_comments_per_pull_request":0.39473684210526316,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":25,"past_year_issues_count":0,"past_year_pull_requests_count":10,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":4389569.222222222,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":9,"past_year_pull_request_authors_count":4,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.2,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":7,"past_year_merged_pull_requests_count":5,"created_at":"2023-05-16T14:18:48.847Z","updated_at":"2026-09-09T21:35:14.434Z","repository_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary","issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/jshttp%2Fvary/issues","issue_labels_count":{"table":{"invalid":1,"enhancement":1}},"pull_request_labels_count":{"table":{"dependencies":25,"github_actions":18,"javascript":7,"fast track":6,"pr":1}},"issue_author_associations_count":{"table":{"MEMBER":2,"NONE":2}},"pull_request_author_associations_count":{"table":{"NONE":17,"CONTRIBUTOR":15,"MEMBER":6}},"issue_authors":{"table":{"jonathanong":2,"nfroidure":1,"lhzcode":1}},"pull_request_authors":{"table":{"dependabot[bot]":25,"UlisesGascon":4,"inigomarquinez":4,"blakeembrey":1,"nook-scheel":1,"sheplu":1,"DakshSinghDhami":1,"raksbisht":1}},"host":{"table":{"name":"GitHub","url":"https://github.com","kind":"github","last_synced_at":"2026-09-10T00:00:06.218Z","repositories_count":17051076,"issues_count":45113187,"pull_requests_count":142017678,"authors_count":11698156,"icon_url":"https://github.com/github.png","host_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories","owners_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/owners","authors_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors"}},"past_year_issue_labels_count":{"table":{}},"past_year_pull_request_labels_count":{"table":{"dependencies":7,"github_actions":7,"fast track":4}},"past_year_issue_author_associations_count":{"table":{}},"past_year_pull_request_author_associations_count":{"table":{"CONTRIBUTOR":7,"MEMBER":2,"NONE":1}},"past_year_issue_authors":{"table":{}},"past_year_pull_request_authors":{"table":{"dependabot[bot]":7,"blakeembrey":1,"DakshSinghDhami":1,"sheplu":1}},"maintainers":[{"table":{"login":"UlisesGascon","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/UlisesGascon"}},{"table":{"login":"jonathanong","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jonathanong"}},{"table":{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"}},{"table":{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}}],"active_maintainers":[{"table":{"login":"blakeembrey","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/blakeembrey"}},{"table":{"login":"sheplu","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/sheplu"}}]}},"events":{"total":{"CreateEvent":16,"DeleteEvent":17,"ForkEvent":2,"IssueCommentEvent":7,"PullRequestEvent":41,"PullRequestReviewEvent":6,"PushEvent":6,"WatchEvent":1},"last_year":{"CreateEvent":8,"DeleteEvent":13,"IssueCommentEvent":4,"PullRequestEvent":29,"PullRequestReviewEvent":2,"PushEvent":5}},"keywords":["http","javascript","nodejs","vary"],"dependencies":[{"ecosystem":"actions","filepath":".github/workflows/codeql.yml","sha":null,"kind":"manifest","created_at":"2026-03-10T09:00:02.662Z","updated_at":"2026-03-10T09:00:02.662Z","repository_link":"https://github.com/jshttp/vary/blob/master/.github/workflows/codeql.yml","dependencies":[{"id":25835478988,"package_name":"actions/checkout","ecosystem":"actions","requirements":"v6.0.2","direct":true,"kind":"composite","optional":false},{"id":25835478990,"package_name":"github/codeql-action/init","ecosystem":"actions","requirements":"v4.32.4","direct":true,"kind":"composite","optional":false},{"id":25835478991,"package_name":"github/codeql-action/autobuild","ecosystem":"actions","requirements":"v4.32.4","direct":true,"kind":"composite","optional":false},{"id":25835478992,"package_name":"github/codeql-action/analyze","ecosystem":"actions","requirements":"v4.32.4","direct":true,"kind":"composite","optional":false}]},{"ecosystem":"npm","filepath":"package.json","sha":null,"kind":"manifest","created_at":"2022-09-12T07:23:06.398Z","updated_at":"2022-09-12T07:23:06.398Z","repository_link":"https://github.com/jshttp/vary/blob/master/package.json","dependencies":[{"id":4578469997,"package_name":"beautify-benchmark","ecosystem":"npm","requirements":"0.2.4","direct":true,"kind":"development","optional":false},{"id":4578469998,"package_name":"benchmark","ecosystem":"npm","requirements":"2.1.4","direct":true,"kind":"development","optional":false},{"id":4578469999,"package_name":"eslint","ecosystem":"npm","requirements":"7.14.0","direct":true,"kind":"development","optional":false},{"id":4578470000,"package_name":"eslint-config-standard","ecosystem":"npm","requirements":"14.1.1","direct":true,"kind":"development","optional":false},{"id":4578470001,"package_name":"eslint-plugin-import","ecosystem":"npm","requirements":"2.22.0","direct":true,"kind":"development","optional":false},{"id":4578470002,"package_name":"eslint-plugin-markdown","ecosystem":"npm","requirements":"1.0.2","direct":true,"kind":"development","optional":false},{"id":4578470003,"package_name":"eslint-plugin-node","ecosystem":"npm","requirements":"11.1.0","direct":true,"kind":"development","optional":false},{"id":4578470004,"package_name":"eslint-plugin-promise","ecosystem":"npm","requirements":"4.2.1","direct":true,"kind":"development","optional":false},{"id":4578470005,"package_name":"eslint-plugin-standard","ecosystem":"npm","requirements":"4.1.0","direct":true,"kind":"development","optional":false},{"id":4578470006,"package_name":"istanbul","ecosystem":"npm","requirements":"0.4.5","direct":true,"kind":"development","optional":false},{"id":4578470007,"package_name":"mocha","ecosystem":"npm","requirements":"8.2.1","direct":true,"kind":"development","optional":false},{"id":4578470008,"package_name":"supertest","ecosystem":"npm","requirements":"4.0.2","direct":true,"kind":"development","optional":false}]},{"ecosystem":"actions","filepath":".github/workflows/ci.yml","sha":null,"kind":"manifest","created_at":"2024-06-18T12:42:11.844Z","updated_at":"2024-06-18T12:42:11.844Z","repository_link":"https://github.com/jshttp/vary/blob/master/.github/workflows/ci.yml","dependencies":[{"id":18675892296,"package_name":"actions/checkout","ecosystem":"actions","requirements":"v4","direct":true,"kind":"composite","optional":false},{"id":18675892297,"package_name":"coverallsapp/github-action","ecosystem":"actions","requirements":"master","direct":true,"kind":"composite","optional":false}]},{"ecosystem":"actions","filepath":".github/workflows/scorecard.yml","sha":null,"kind":"manifest","created_at":"2024-06-18T12:42:12.110Z","updated_at":"2024-06-18T12:42:12.110Z","repository_link":"https://github.com/jshttp/vary/blob/master/.github/workflows/scorecard.yml","dependencies":[{"id":18675892298,"package_name":"actions/checkout","ecosystem":"actions","requirements":"b4ffde65f46336ab88eb53be808477a3936bae11","direct":true,"kind":"composite","optional":false},{"id":18675892299,"package_name":"ossf/scorecard-action","ecosystem":"actions","requirements":"0864cf19026789058feabb7e87baa5f140aac736","direct":true,"kind":"composite","optional":false},{"id":18675892300,"package_name":"actions/upload-artifact","ecosystem":"actions","requirements":"5d5d22a31266ced268874388b861e4b58bb5c2f3","direct":true,"kind":"composite","optional":false},{"id":18675892301,"package_name":"github/codeql-action/upload-sarif","ecosystem":"actions","requirements":"2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f","direct":true,"kind":"composite","optional":false}]}],"score":29.005076689107863,"created_at":"2026-07-08T06:07:26.061Z","updated_at":"2026-09-10T22:05:03.384Z","avatar_url":"https://github.com/jshttp.png","language":"JavaScript","codemeta":null,"publiccode":null,"project_url":"https://summary.ecosyste.ms/api/v1/projects/377920","html_url":"https://summary.ecosyste.ms/projects/377920"}