OpenSSF Scorecard checklist

[danielroe]

As part of improving Nuxt's security profile, I'm working through implementing recommendations from the OSSF Scorecard. While not all of them will be relevant for Nuxt, I still think there are some best practices we can implement.

Tasks

Beta Give feedback

1. CI-Tests: 26 out of 26 merged PRs checked by a CI test -- score normalized to 10 - more info
2. Contributors: 72 different organizations found -- score normalized to 10 - more info
3. Dangerous-Workflow: no dangerous workflow patterns detected - more info
4. Dependency-Update-Tool: update tool detected - more info
5. License: license file detected - more info
6. Maintained: 30 commit(s) out of 30 and 23 issue activity out of 30 found in the last 90 days -- score normalized to 10 - more info
7. Packaging: publishing workflow detected - more info
8. Security-Policy: security policy file detected - more info
9. Binary-Artifacts: binaries present in source code - more info
10. SAST: SAST tool is not run on all commits -- score normalized to 0 - more info - ci: add codeql analysis step #21324
11. CII-Best-Practices: - more info
12. Vulnerabilities: 2 existing vulnerabilities detected - more info: chore: rewrite crawler to remove old dependencies #21326
13. Pinned-Dependencies: dependency not pinned by hash detected -- score normalized to 4 - more info - ci: apply security best practices to workflows #21328
14. Branch-Protection: branch protection is not maximal on development and all release branches - more info
15. Code-Review: found 8 unreviewed human changesets (30 total - more info)
16. Fuzzing: project is not fuzzed - more info
17. Token-Permissions: non read-only tokens detected in GitHub workflows - more info - ci: apply security best practices to workflows #21328
18. Signed-Releases: no releases found - more info

[Hebilicious]

Great idea ! I would love to have more sensible security defaults out-of-the box.

A few things that comes to mind :

• Add a security section to the box
• add an origin check for POST requests and a flag to disable it, similar to sveltekit
• Add some of the security features provided by nuxt/security in core