{
  "accepted": [
    {
      "id": "go/weak-sensitive-data-hashing",
      "matched": false,
      "package": "internal/evidence/formats/pgbackrest/cipher.go",
      "reason": "mandated by the format: SHA-1 EVP_BytesToKey (count 1) is the key derivation pgBackRest repository format 5 writes every encrypted file with (cipherBlock.c, 2.60.0), so a reader cannot open the files with any other; the derived key opens one file in memory and is never stored or sent, and format 6 is refused.",
      "scanner": "codeql"
    },
    {
      "id": "go/weak-sensitive-data-hashing",
      "matched": false,
      "package": "internal/operator/specs/specs.go",
      "reason": "not secret: no password reaches Hash; the \"password\" CodeQL names is the Secret name \"<name>-pgadmin-config-password\" (internal/operator/pgadmin/configdb.go configPasswordSecretName), and the SHA-256 is a drift fingerprint of a rendered spec, not a password hash.",
      "scanner": "codeql"
    },
    {
      "id": "GO-2026-5064",
      "matched": true,
      "package": "github.com/containerd/containerd",
      "reason": "not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
      "scanner": "grype"
    },
    {
      "id": "GO-2026-5338",
      "matched": true,
      "package": "github.com/containerd/containerd",
      "reason": "not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
      "scanner": "grype"
    },
    {
      "id": "GO-2026-5622",
      "matched": true,
      "package": "github.com/containerd/containerd",
      "reason": "not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
      "scanner": "grype"
    },
    {
      "id": "GO-2026-6791",
      "matched": true,
      "package": "github.com/containerd/containerd",
      "reason": "not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
      "scanner": "grype"
    }
  ],
  "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
  "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
  "envelopes": [
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43367992906",
      "scanned_at": "2026-11-13T03:44:43Z",
      "scanner": "codeql",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "",
      "title": "CodeQL: code scanning",
      "tool": {
        "name": "CodeQL",
        "version": "2.27.4"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:27Z",
      "scanner": "gitleaks",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "",
      "title": "Gitleaks: secrets in history",
      "tool": {
        "name": "gitleaks",
        "version": "8.30.1"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:44:02Z",
      "scanner": "gosec",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "pkg/evidence",
      "title": "gosec: Go static analysis",
      "tool": {
        "name": "gosec",
        "version": "2.15.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:44:02Z",
      "scanner": "gosec",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "root",
      "title": "gosec: Go static analysis",
      "tool": {
        "name": "gosec",
        "version": "2.15.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:46Z",
      "scanner": "govulncheck",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "pkg/evidence",
      "title": "govulncheck: Go call graph",
      "tool": {
        "name": "govulncheck",
        "version": "1.9.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:46Z",
      "scanner": "govulncheck",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "root",
      "title": "govulncheck: Go call graph",
      "tool": {
        "name": "govulncheck",
        "version": "1.9.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:42:56Z",
      "scanner": "grype",
      "schema": 1,
      "status": "ok",
      "subject": {
        "digest": "sha256:6721cd58a1870d7f7c41831ee3fd03493f593c176052d9a429fcd60657da21ce",
        "image": "pgtoolbox-bundle:ci",
        "image_id": "sha256:b4b26803b596c1e4a382bd3e4cccfe5ba0a262a959dda86a92696903b5aa6aad"
      },
      "target": "pgtoolbox-bundle",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [
        {
          "fix": "unknown",
          "fixed_in": [],
          "id": "GO-2026-5064",
          "location": "/usr/bin/opm",
          "package": "github.com/containerd/containerd",
          "severity": "critical",
          "title": "",
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
          "version": "v1.7.36"
        },
        {
          "fix": "unknown",
          "fixed_in": [],
          "id": "GO-2026-5338",
          "location": "/usr/bin/opm",
          "package": "github.com/containerd/containerd",
          "severity": "critical",
          "title": "",
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574",
          "version": "v1.7.36"
        },
        {
          "fix": "unknown",
          "fixed_in": [],
          "id": "GO-2026-5622",
          "location": "/usr/bin/opm",
          "package": "github.com/containerd/containerd",
          "severity": "medium",
          "title": "",
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388",
          "version": "v1.7.36"
        },
        {
          "fix": "unknown",
          "fixed_in": [],
          "id": "GO-2026-6791",
          "location": "/usr/bin/opm",
          "package": "github.com/containerd/containerd",
          "severity": "high",
          "title": "",
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f",
          "version": "v1.7.36"
        }
      ],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:44:55Z",
      "scanner": "grype",
      "schema": 1,
      "status": "ok",
      "subject": {
        "digest": "sha256:480b90f773c064f03d7255a8d394d7f4e7dc9abfc5edce63f0d64aa0459f8bf5",
        "image": "pgtoolbox-catalog:ci",
        "image_id": "sha256:709a610084ded0e1017f240ccccc73db394c285f633e02bcc7b262e8c8379625"
      },
      "target": "pgtoolbox-catalog",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:47:08Z",
      "scanner": "grype",
      "schema": 1,
      "status": "ok",
      "subject": {
        "digest": "sha256:f1640aad14cd381ffe7911a0aa05b229591fe5dc0ba60259478c94d73c4c593b",
        "image": "pgtoolbox-console:ci",
        "image_id": "sha256:51bd0fd3958b483a4d1ea0bfe35d835a197557470f8a227eb1891bf819f34a82"
      },
      "target": "pgtoolbox-console",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:47:39Z",
      "scanner": "grype",
      "schema": 1,
      "status": "ok",
      "subject": {
        "digest": "sha256:d72557236754c05c41d005a3b2bc0b53d5bad1fb84a5a9b83348bd5aad8c54fc",
        "image": "pgtoolbox-evidence-agent:ci",
        "image_id": "sha256:63767f5555213a1143687bce9d4d541f34a304f55fdea4cf8320d1059f951bb7"
      },
      "target": "pgtoolbox-evidence-agent",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:46:28Z",
      "scanner": "grype",
      "schema": 1,
      "status": "ok",
      "subject": {
        "digest": "sha256:5075376bbe73098f3da6f236fed4c178af85a792ca5ffcab01537424a315b0aa",
        "image": "pgtoolbox-operator:ci",
        "image_id": "sha256:40d492e0fcf9c272d89e9acfb6a3446236dbca67c3178d30ab9b6939adaf3ac8"
      },
      "target": "pgtoolbox-operator",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "optional": true,
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:30Z",
      "scanner": "grype",
      "schema": 1,
      "status": "not-run",
      "subject": {},
      "target": "published-pgtoolbox-console",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": ""
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "optional": true,
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "grype",
      "schema": 1,
      "status": "not-run",
      "subject": {},
      "target": "published-pgtoolbox-evidence-agent",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": ""
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "optional": true,
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:25Z",
      "scanner": "grype",
      "schema": 1,
      "status": "not-run",
      "subject": {},
      "target": "published-pgtoolbox-operator",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": ""
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "kube-linter",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "pgtoolbox",
      "title": "kube-linter: Helm charts",
      "tool": {
        "name": "kube-linter",
        "version": "0.8.3"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "kube-linter",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "pgtools",
      "title": "kube-linter: Helm charts",
      "tool": {
        "name": "kube-linter",
        "version": "0.8.3"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [
        {
          "fix": "none",
          "fixed_in": [],
          "id": "GHSA-gcqx-w48m-w2h4",
          "location": "/home/runner/work/pgToolBox/pgToolBox/docs/site/package-lock.json",
          "package": "deepmerge",
          "severity": "medium",
          "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
          "url": "https://osv.dev/GHSA-gcqx-w48m-w2h4",
          "version": "4.3.1"
        },
        {
          "fix": "none",
          "fixed_in": [],
          "id": "GHSA-gcqx-w48m-w2h4",
          "location": "/home/runner/work/pgToolBox/pgToolBox/headlamp/package-lock.json",
          "package": "deepmerge",
          "severity": "medium",
          "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
          "url": "https://osv.dev/GHSA-gcqx-w48m-w2h4",
          "version": "4.3.1"
        },
        {
          "fix": "none",
          "fixed_in": [],
          "id": "GHSA-848j-6mx2-7j84",
          "location": "/home/runner/work/pgToolBox/pgToolBox/headlamp/package-lock.json",
          "package": "elliptic",
          "severity": "medium",
          "title": "Elliptic Uses a Cryptographic Primitive with a Risky Implementation",
          "url": "https://osv.dev/GHSA-848j-6mx2-7j84",
          "version": "6.6.1"
        }
      ],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:23Z",
      "scanner": "osv-scanner",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "",
      "title": "OSV-Scanner: npm and Go lockfiles",
      "tool": {
        "name": "osv-scanner",
        "version": "2.7.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "event": "schedule",
      "findings": [],
      "reason": "",
      "ref": "refs/heads/main",
      "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "zizmor",
      "schema": 1,
      "status": "ok",
      "subject": {},
      "target": "",
      "title": "zizmor: GitHub Actions workflows",
      "tool": {
        "name": "zizmor",
        "version": "1.31.1"
      }
    }
  ],
  "event": "schedule",
  "findings": {
    "omitted": 0,
    "ran": 15,
    "rows": [
      {
        "fix": {
          "fixed_in": [],
          "label": "accepted: not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
          "state": "accepted"
        },
        "id": "GO-2026-5064",
        "location": "github.com/containerd/containerd",
        "scanner": "grype",
        "severity": "critical",
        "target": "pgtoolbox-catalog",
        "title": "",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
        "version": "v1.7.36"
      },
      {
        "fix": {
          "fixed_in": [],
          "label": "accepted: not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
          "state": "accepted"
        },
        "id": "GO-2026-5338",
        "location": "github.com/containerd/containerd",
        "scanner": "grype",
        "severity": "critical",
        "target": "pgtoolbox-catalog",
        "title": "",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574",
        "version": "v1.7.36"
      },
      {
        "fix": {
          "fixed_in": [],
          "label": "accepted: not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
          "state": "accepted"
        },
        "id": "GO-2026-6791",
        "location": "github.com/containerd/containerd",
        "scanner": "grype",
        "severity": "high",
        "target": "pgtoolbox-catalog",
        "title": "",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f",
        "version": "v1.7.36"
      },
      {
        "fix": {
          "fixed_in": [],
          "label": "accepted: not reachable: all four containerd advisories are bugs in containerd's CRI plugin (pkg/cri). `GOWORK=off CGO_ENABLED=0 go list -deps -tags json1,netgo,osusergo,containers_image_openpgp` in deploy/olm/catalog/opm, the exact build of catalog.Dockerfile, shows opm linking only containerd archive, content, images, metadata, mount, remotes and their helpers, no pkg/cri and no containerd daemon or plugin code, and grpc_health_probe linking no containerd package at all; containerd 1.7.36 is the version operator-registry v1.74.0 requires and the advisories have no v1 fix.",
          "state": "accepted"
        },
        "id": "GO-2026-5622",
        "location": "github.com/containerd/containerd",
        "scanner": "grype",
        "severity": "medium",
        "target": "pgtoolbox-catalog",
        "title": "",
        "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388",
        "version": "v1.7.36"
      },
      {
        "fix": {
          "fixed_in": [],
          "label": "no fix yet (stays open)",
          "state": "none"
        },
        "id": "GHSA-848j-6mx2-7j84",
        "location": "elliptic",
        "scanner": "osv-scanner",
        "severity": "medium",
        "target": "",
        "title": "Elliptic Uses a Cryptographic Primitive with a Risky Implementation",
        "url": "https://osv.dev/GHSA-848j-6mx2-7j84",
        "version": "6.6.1"
      },
      {
        "fix": {
          "fixed_in": [],
          "label": "no fix yet (stays open)",
          "state": "none"
        },
        "id": "GHSA-gcqx-w48m-w2h4",
        "location": "deepmerge",
        "scanner": "osv-scanner",
        "severity": "medium",
        "target": "",
        "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
        "url": "https://osv.dev/GHSA-gcqx-w48m-w2h4",
        "version": "4.3.1"
      },
      {
        "fix": {
          "fixed_in": [],
          "label": "no fix yet (stays open)",
          "state": "none"
        },
        "id": "GHSA-gcqx-w48m-w2h4",
        "location": "deepmerge",
        "scanner": "osv-scanner",
        "severity": "medium",
        "target": "",
        "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
        "url": "https://osv.dev/GHSA-gcqx-w48m-w2h4",
        "version": "4.3.1"
      }
    ],
    "state": "listed",
    "total": 7
  },
  "generated_at": "2026-11-13T03:48:20Z",
  "images": [
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "sha256:6721cd58a1870d7f7c41831ee3fd03493f593c176052d9a429fcd60657da21ce",
      "image": "pgtoolbox-bundle:ci",
      "image_id": "sha256:b4b26803b596c1e4a382bd3e4cccfe5ba0a262a959dda86a92696903b5aa6aad",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-bundle"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "sha256:480b90f773c064f03d7255a8d394d7f4e7dc9abfc5edce63f0d64aa0459f8bf5",
      "image": "pgtoolbox-catalog:ci",
      "image_id": "sha256:709a610084ded0e1017f240ccccc73db394c285f633e02bcc7b262e8c8379625",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-catalog"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "sha256:f1640aad14cd381ffe7911a0aa05b229591fe5dc0ba60259478c94d73c4c593b",
      "image": "pgtoolbox-console:ci",
      "image_id": "sha256:51bd0fd3958b483a4d1ea0bfe35d835a197557470f8a227eb1891bf819f34a82",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-console"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "sha256:d72557236754c05c41d005a3b2bc0b53d5bad1fb84a5a9b83348bd5aad8c54fc",
      "image": "pgtoolbox-evidence-agent:ci",
      "image_id": "sha256:63767f5555213a1143687bce9d4d541f34a304f55fdea4cf8320d1059f951bb7",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-evidence-agent"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "sha256:5075376bbe73098f3da6f236fed4c178af85a792ca5ffcab01537424a315b0aa",
      "image": "pgtoolbox-operator:ci",
      "image_id": "sha256:40d492e0fcf9c272d89e9acfb6a3446236dbca67c3178d30ab9b6939adaf3ac8",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-operator"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "",
      "image": "published-pgtoolbox-console",
      "image_id": "",
      "status": "not-run",
      "status_label": "not run",
      "target": "published-pgtoolbox-console"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "",
      "image": "published-pgtoolbox-evidence-agent",
      "image_id": "",
      "status": "not-run",
      "status_label": "not run",
      "target": "published-pgtoolbox-evidence-agent"
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "digest": "",
      "image": "published-pgtoolbox-operator",
      "image_id": "",
      "status": "not-run",
      "status_label": "not run",
      "target": "published-pgtoolbox-operator"
    }
  ],
  "kind": "pgtoolbox.security-results",
  "missing": [
    {
      "name": "Grype: container images (published-pgtoolbox-console)",
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "status": "not-run",
      "status_label": "not run"
    },
    {
      "name": "Grype: container images (published-pgtoolbox-evidence-agent)",
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "status": "not-run",
      "status_label": "not run"
    },
    {
      "name": "Grype: container images (published-pgtoolbox-operator)",
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "status": "not-run",
      "status_label": "not run"
    }
  ],
  "published": true,
  "ref": "refs/heads/main",
  "run_url": "https://github.com/fyannk/pgToolBox/actions/runs/43360598857",
  "scanners": [
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "CodeQL: code scanning",
      "reason": "",
      "scanned_at": "2026-11-13T03:44:43Z",
      "scanner": "codeql",
      "status": "ok",
      "status_label": "ok",
      "target": "",
      "title": "CodeQL: code scanning",
      "tool": {
        "name": "CodeQL",
        "version": "2.27.4"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "Gitleaks: secrets in history",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:27Z",
      "scanner": "gitleaks",
      "status": "ok",
      "status_label": "ok",
      "target": "",
      "title": "Gitleaks: secrets in history",
      "tool": {
        "name": "gitleaks",
        "version": "8.30.1"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "gosec: Go static analysis (pkg/evidence)",
      "reason": "",
      "scanned_at": "2026-11-13T03:44:02Z",
      "scanner": "gosec",
      "status": "ok",
      "status_label": "ok",
      "target": "pkg/evidence",
      "title": "gosec: Go static analysis",
      "tool": {
        "name": "gosec",
        "version": "2.15.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "gosec: Go static analysis (root)",
      "reason": "",
      "scanned_at": "2026-11-13T03:44:02Z",
      "scanner": "gosec",
      "status": "ok",
      "status_label": "ok",
      "target": "root",
      "title": "gosec: Go static analysis",
      "tool": {
        "name": "gosec",
        "version": "2.15.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "govulncheck: Go call graph (pkg/evidence)",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:46Z",
      "scanner": "govulncheck",
      "status": "ok",
      "status_label": "ok",
      "target": "pkg/evidence",
      "title": "govulncheck: Go call graph",
      "tool": {
        "name": "govulncheck",
        "version": "1.9.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "govulncheck: Go call graph (root)",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:46Z",
      "scanner": "govulncheck",
      "status": "ok",
      "status_label": "ok",
      "target": "root",
      "title": "govulncheck: Go call graph",
      "tool": {
        "name": "govulncheck",
        "version": "1.9.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": 0,
      "name": "Grype: container images (pgtoolbox-bundle)",
      "reason": "",
      "scanned_at": "2026-11-13T03:42:56Z",
      "scanner": "grype",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-bundle",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 2,
        "high": 1,
        "low": 0,
        "medium": 1,
        "unknown": 0
      },
      "fixable": 0,
      "name": "Grype: container images (pgtoolbox-catalog)",
      "reason": "",
      "scanned_at": "2026-11-13T03:44:55Z",
      "scanner": "grype",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-catalog",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": 0,
      "name": "Grype: container images (pgtoolbox-console)",
      "reason": "",
      "scanned_at": "2026-11-13T03:47:08Z",
      "scanner": "grype",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-console",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": 0,
      "name": "Grype: container images (pgtoolbox-evidence-agent)",
      "reason": "",
      "scanned_at": "2026-11-13T03:47:39Z",
      "scanner": "grype",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-evidence-agent",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": 0,
      "name": "Grype: container images (pgtoolbox-operator)",
      "reason": "",
      "scanned_at": "2026-11-13T03:46:28Z",
      "scanner": "grype",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox-operator",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": "0.121.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": null,
      "fixable": null,
      "name": "Grype: container images (published-pgtoolbox-console)",
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "scanned_at": "2026-11-13T03:41:30Z",
      "scanner": "grype",
      "status": "not-run",
      "status_label": "not run",
      "target": "published-pgtoolbox-console",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": ""
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": null,
      "fixable": null,
      "name": "Grype: container images (published-pgtoolbox-evidence-agent)",
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "grype",
      "status": "not-run",
      "status_label": "not run",
      "target": "published-pgtoolbox-evidence-agent",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": ""
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": null,
      "fixable": null,
      "name": "Grype: container images (published-pgtoolbox-operator)",
      "reason": "the latest image could not be read: no stable release is published yet, or its package is not public",
      "scanned_at": "2026-11-13T03:41:25Z",
      "scanner": "grype",
      "status": "not-run",
      "status_label": "not run",
      "target": "published-pgtoolbox-operator",
      "title": "Grype: container images",
      "tool": {
        "name": "grype",
        "version": ""
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "kube-linter: Helm charts (pgtoolbox)",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "kube-linter",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtoolbox",
      "title": "kube-linter: Helm charts",
      "tool": {
        "name": "kube-linter",
        "version": "0.8.3"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "kube-linter: Helm charts (pgtools)",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "kube-linter",
      "status": "ok",
      "status_label": "ok",
      "target": "pgtools",
      "title": "kube-linter: Helm charts",
      "tool": {
        "name": "kube-linter",
        "version": "0.8.3"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 3,
        "unknown": 0
      },
      "fixable": 0,
      "name": "OSV-Scanner: npm and Go lockfiles",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:23Z",
      "scanner": "osv-scanner",
      "status": "ok",
      "status_label": "ok",
      "target": "",
      "title": "OSV-Scanner: npm and Go lockfiles",
      "tool": {
        "name": "osv-scanner",
        "version": "2.7.0"
      }
    },
    {
      "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
      "counts": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "unknown": 0
      },
      "fixable": null,
      "name": "zizmor: GitHub Actions workflows",
      "reason": "",
      "scanned_at": "2026-11-13T03:41:21Z",
      "scanner": "zizmor",
      "status": "ok",
      "status_label": "ok",
      "target": "",
      "title": "zizmor: GitHub Actions workflows",
      "tool": {
        "name": "zizmor",
        "version": "1.31.1"
      }
    }
  ],
  "schema": 2,
  "scorecard": {
    "checks": [
      {
        "name": "Code-Review",
        "reason": "Found 0/26 approved changesets -- score normalized to 0",
        "score": 0
      },
      {
        "name": "Security-Policy",
        "reason": "security policy file detected",
        "score": 10
      },
      {
        "name": "Dependency-Update-Tool",
        "reason": "update tool detected",
        "score": 10
      },
      {
        "name": "Maintained",
        "reason": "project was created within the last 90 days. Please review its contents carefully",
        "score": 0
      },
      {
        "name": "Dangerous-Workflow",
        "reason": "no dangerous workflow patterns detected",
        "score": 10
      },
      {
        "name": "Token-Permissions",
        "reason": "GitHub workflow tokens follow principle of least privilege",
        "score": 10
      },
      {
        "name": "Binary-Artifacts",
        "reason": "no binaries found in the repo",
        "score": 10
      },
      {
        "name": "Pinned-Dependencies",
        "reason": "all dependencies are pinned",
        "score": 10
      },
      {
        "name": "CII-Best-Practices",
        "reason": "badge detected: Passing",
        "score": 5
      },
      {
        "name": "SAST",
        "reason": "SAST tool is run on all commits",
        "score": 10
      },
      {
        "name": "Fuzzing",
        "reason": "project is fuzzed",
        "score": 10
      },
      {
        "name": "Vulnerabilities",
        "reason": "7 existing vulnerabilities detected",
        "score": 3
      },
      {
        "name": "License",
        "reason": "license file detected",
        "score": 10
      },
      {
        "name": "Branch-Protection",
        "reason": "branch protection is not maximal on development and all release branches",
        "score": 3
      },
      {
        "name": "Signed-Releases",
        "reason": "no releases found",
        "score": -1
      },
      {
        "name": "Packaging",
        "reason": "packaging workflow detected",
        "score": 10
      },
      {
        "name": "Contributors",
        "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
        "score": 0
      },
      {
        "name": "CI-Tests",
        "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
        "score": 10
      }
    ],
    "commit": "ffd267838ab2998c3812f0a8545f7108b3ce81fc",
    "commit_url": "https://github.com/fyannk/pgToolBox/commit/ffd267838ab2998c3812f0a8545f7108b3ce81fc",
    "date": "2026-11-12T19:48:24Z",
    "reason": "",
    "report_url": "https://scorecard.dev/viewer/?uri=github.com/fyannk/pgToolBox",
    "score": 7,
    "status": "ok",
    "status_label": "ok",
    "version": "v5.6.0"
  }
}