{"id":12886,"user_id":50042,"name":"api","description":"Simple Container (sc) is a cloud-agnostic deployment tool designed to simplify microservices deployment, infrastructure provisioning, and CI/CD automation.","homepage_url":"https://simple-container.com","repo_url":"https://github.com/simple-container-com/api","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","sites_https_justification":"Given only https: URLs.","description_good_status":"Met","description_good_justification":"https://simple-container.com/features/","interact_status":"Met","interact_justification":"support@simple-container.com","contribution_status":"Met","contribution_justification":"Projects on GitHub by default use issues and pull requests, as encouraged by documentation such as \u003chttps://guides.github.com/activities/contributing-to-open-source/\u003e.","contribution_requirements_status":"Met","contribution_requirements_justification":"https://github.com/simple-container-com/api/blob/main/docs/CONTRIBUTING.md","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/simple-container-com/api/blob/main/LICENSE\u003e.","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"Some documentation basics file contents found.","documentation_interface_status":"Met","documentation_interface_justification":"https://docs.simple-container.com/","repo_public_status":"Met","repo_public_justification":"Repository on GitHub, which provides public git repositories with URLs.","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"calver is used","version_semver_status":"Met","version_tags_status":"Met","release_notes_status":"Met","release_notes_justification":"https://github.com/simple-container-com/api/releases","release_notes_vulns_status":"N/A","release_notes_vulns_justification":"Per the criterion text: \"This criterion applies only to the project results, not to its dependencies. If there are no release notes or there have been no publicly known vulnerabilities, choose N/A.\"\r\n\r\nNo publicly-known run-time vulnerability has ever been fixed in simple-container-com/api's own code.","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"GitHub Issues: https://github.com/simple-container-com/api/issues.","report_process_status":"Met","report_process_justification":"URL: https://github.com/simple-container-com/api/issues/new/choose\r\nBugs are reported via GitHub Issues on this repository. The issue tracker is open to the public and is the canonical channel for non-security bug reports.","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://github.com/simple-container-com/api/security/advisories\r\n\r\n","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/SECURITY.md\r\nSECURITY.md documents the vulnerability reporting process, acknowledgement SLA, fix-shipping SLA per severity, and public disclosure cadence.","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/SECURITY.md\r\nGitHub Security Advisories (private to maintainers) is the preferred channel. Email fallbacks are documented in SECURITY.md.","vulnerability_report_response_status":"Met","build_status":"Met","build_common_tools_status":"Met","build_floss_tools_status":"Met","test_status":"Met","test_invocation_status":"Met","test_invocation_justification":"The test suite is invoked the standard Go way: `go test ./...` (unit) and `go test -tags integration ./...` (integration); an aggregate coverage run is `welder run coverage`. Documented at https://github.com/simple-container-com/api/blob/main/docs/CONTRIBUTING.md and https://github.com/simple-container-com/api/blob/main/docs/TESTING.md .","test_most_status":"Met","test_policy_status":"Met","tests_are_added_status":"Met","tests_documented_added_status":"Met","tests_documented_added_justification":"docs/CONTRIBUTING.md requires PRs touching production code paths to include unit tests covering the new behaviour, with stricter standards for security-sensitive paths (pkg/security/, push.yaml, sc.sh, anything in the SLSA / cosign / Sigstore chain). PRs lacking tests are blocked at maintainer review.\r\n\r\nURL: https://github.com/simple-container-com/api/blob/main/docs/CONTRIBUTING.md","warnings_status":"Met","warnings_fixed_status":"Met","warnings_strict_status":"Met","warnings_strict_justification":"golangci-lint runs in CI with a strict ruleset (gofmt, goimports, govet, staticcheck, errcheck, ineffassign, unused, gosec) and any warning fails the build — there is no \"warning, don't fail\" tier. Configuration is at .golangci.yml. CI invocation is in .github/workflows/build-staging.yml.","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"Met","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_mitm_justification":"Distribution channels use HTTPS exclusively. [osps_br_03_02]","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"semgrep + CodeQL","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"Four FLOSS analyzers run on every PR; each blocks merge on findings:\r\n\r\nCodeQL (Go) — .github/workflows/codeql.yml\r\nSemgrep with custom org rules — .github/workflows/semgrep.yml\r\ngosec + staticcheck via golangci-lint — .golangci.yml\r\ngovulncheck (reachability-aware) — .github/workflows/govulncheck.yml\r\nSuppressions go through the OpenVEX not_affected channel (vex/openvex.json) only — .trivyignore / # nosemgrep / // nolint: are banned by docs/DEPENDENCIES.md policy.","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"Met","dynamic_analysis_justification":"Native Go fuzzing is applied in CI as a dynamic-analysis tool: .github/workflows/fuzz.yml ('Go Fuzz') runs FuzzVerifyAndExtract and FuzzCacheGetPath against the security-critical HMAC integrity-cache parse path (pkg/security/cache.go) on every PR/push and for an extended budget on main. Fuzzing executes the code with generated inputs and surfaces crashes/panics. Workflow: https://github.com/simple-container-com/api/blob/main/.github/workflows/fuzz.yml .","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_unsafe_justification":"The software is written entirely in Go (memory-safe). CGO_ENABLED=0 for release builds — no C/C++ dependencies; binaries are fully static. The criterion does not apply.","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_enable_assertions_justification":"The fuzz harnesses assert security invariants on every iteration: FuzzVerifyAndExtract requires forged/tampered ciphertext to be rejected and valid input to round-trip; FuzzCacheGetPath asserts no resolved path escapes the cache directory (path-traversal guard). Go's always-on runtime checks (bounds, nil-deref, integer-overflow -\u003e panic) act as pervasive runtime assertions exercised throughout the fuzzed executions, so any violated invariant surfaces as a fuzz crash","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2026-05-18T17:21:24.681Z","updated_at":"2026-06-21T12:10:40.940Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"Default crypto primitives in the codebase:\r\n\r\nHMAC: HMAC-SHA256 (pkg/security/cache.go)\r\nPublic-key encryption: RSA-OAEP-SHA256 and ed25519+ChaCha20-Poly1305 (pkg/api/secrets/ciphers/encryption.go)\r\nKey derivation: HKDF-SHA256\r\nArtifact signing: Sigstore/cosign (ECDSA P-256 + SHA-256 by default)\r\nTLS: Go stdlib defaults (TLS 1.3 preferred, 1.2 floor)\r\nNo SHA-1, MD5, RC4, single-DES, or CBC-without-MAC paths in any production code.","test_continuous_integration_status":"Met","test_continuous_integration_justification":"CI runs on every push and pull request via GitHub Actions: .github/workflows/branch.yaml builds and runs the full `go test` suite, coverage.yml measures statement coverage, and fuzz.yml runs the fuzz targets - on each change. Workflows: https://github.com/simple-container-com/api/tree/main/.github/workflows .","cpe":"","discussion_status":"Met","discussion_justification":"GitHub supports discussions on issues and pull requests.","no_leaked_credentials_status":"Met","english_status":"Met","english_justification":"https://docs.simple-container.com/","hardening_status":"Met","hardening_justification":"Hardening of the produced artifacts. (1) Build: release binaries use -trimpath + CGO_ENABLED=0 (static, reproducible - https://github.com/simple-container-com/api/blob/main/docs/REPRODUCIBLE-BUILD.md); container images use multi-stage Dockerfiles on SHA-digest-pinned base images (e.g. github-actions.Dockerfile and caddy.Dockerfile pin alpine:3.23@sha256:... and caddy:2.11.4@sha256:...). (2) CI: every workflow declares least-privilege permissions and pins third-party actions to full commit SHAs; release signing uses GitHub OIDC keyless Sigstore/cosign instead of long-lived secrets - https://github.com/simple-container-com/api/tree/main/.github/workflows. (3) Distribution: the install bootstrap sc.sh, when cosign is on PATH, verifies the keyless Sigstore signature against the maintainer identity and aborts on a verification/fetch failure (it warns and continues only when cosign is absent, to avoid hard-blocking fresh installs) - https://github.com/simple-container-com/api/blob/main/sc.sh.\r\n","crypto_used_network_status":"Met","crypto_used_network_justification":"All outbound network traffic uses HTTPS (TLS 1.2+) or SSH (Sigstore Fulcio + Rekor, GitHub API, AWS/GCP/Azure SDKs, dist.simple-container.com). Go stdlib net/http.Transport defaults reject TLS 1.0/1.1. No FTP / telnet / plaintext HTTP code paths.","crypto_tls12_status":"Met","crypto_tls12_justification":"Go stdlib crypto/tls defaults to TLS 1.3 with TLS 1.2 floor. The codebase does not override MinVersion to any value below tls.VersionTLS12 in any production code path.","crypto_certificate_verification_status":"Met","crypto_certificate_verification_justification":"Go stdlib http.Transport verifies certificates by default. grep -rn \"InsecureSkipVerify\" --include=\"*.go\" returns zero hits in production code; the only matches are in a Semgrep test fixture (actions/semgrep-scan/tests/go_cases.go) used to validate our own SAST rule that flags this anti-pattern.","crypto_verification_private_status":"Met","crypto_verification_private_justification":"Same Go stdlib behaviour — the TLS handshake (including certificate validation) completes before any application data, including request headers or secure cookies, is transmitted. We do not implement a custom HTTP client that bypasses this ordering.","hardened_site_status":"Met","hardened_site_justification":"Required security hardening headers missing: https://simple-container.com: content-security-policy, strict-transport-security, x-content-type-options, x-frame-options","installation_common_status":"Met","installation_common_justification":"Install via the signature-verified bootstrap:\r\ncurl -s \"https://dist.simple-container.com/sc.sh\" | bash\r\nwhich fetches the platform tarball, verifies the cosign signature against the maintainer's identity, and places the sc binary on $PATH. Uninstall is rm $(which sc) — a single static binary. The same bootstrap on a newer release performs an upgrade.","build_reproducible_status":"Met","build_reproducible_justification":"Release binaries (sc, cloud-helpers, github-actions) and the published sc-\u003cos\u003e-\u003carch\u003e.tar.gz archives are built deterministically. The publishing workflow (.github/workflows/push.yaml) and the welder build tasks use `-trimpath` + `-buildvcs=false` + `CGO_ENABLED=0` + a Go toolchain pinned in go.mod + a deterministic version ld-flag, and the tarball is produced with `tar --sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner --mode=u=rwx,go=rx | gzip -9 -n` (fixed entry order/mtime/owner/mode, no embedded gzip timestamp). Verified bit-for-bit: two independent builds under different umasks (022 vs 077) produced identical binary and archive sha256 digests. AI-assistant embeddings are committed (no LLM at build). Inputs + a rebuild-and-compare recipe vs the published cosign/SLSA digest: https://github.com/simple-container-com/api/blob/main/docs/REPRODUCIBLE-BUILD.md . Delivered in PR #335 (merged).","badge_percentage_0":100,"achieved_passing_at":"2026-05-18T19:54:09.778Z","lost_passing_at":"2026-05-18T19:51:03.949Z","last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"Go, Shell, Dockerfile","lock_version":27,"badge_percentage_1":100,"dco_status":"Met","dco_justification":"URL: https://github.com/simple-container-com/api/blob/main/.github/workflows/dco.yml\r\n\r\nAll commits require a Signed-off-by: (DCO) trailer; enforced automatically on every PR via dco.yml. Documented in docs/CONTRIBUTING.md.","governance_status":"Met","governance_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/MAINTAINERS.md\r\n\r\nMAINTAINERS.md documents roles, decision-making, contributor promotion, and onboarding/offboarding. Decisions land via PRs reviewed by maintainers per branch-protection rules.","code_of_conduct_status":"Met","code_of_conduct_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/CODE_OF_CONDUCT.md\r\nContributor Covenant v2.1 at repo root. Standard adoption.","roles_responsibilities_status":"Met","roles_responsibilities_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/MAINTAINERS.md\r\n\r\nMAINTAINERS.md defines Maintainer / Reviewer / Contributor roles with explicit responsibilities, and lists who currently holds each role.","access_continuity_status":"Met","access_continuity_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/MAINTAINERS.md#sensitive-resource-access-map\r\n\r\nMultiple active maintainers share GitHub org admin + Docker Hub + Cloudflare + dist bucket access. Any one maintainer's absence does not block issue triage, PR merge, or release.","bus_factor_status":"Met","bus_factor_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/MAINTAINERS.md#sensitive-resource-access-map\r\n\r\nThree active maintainers with merge access (per current git shortlog of main).","documentation_roadmap_status":"Met","documentation_roadmap_justification":"URL: https://github.com/simple-container-com/api/blob/main/ROADMAP.md\r\n\r\nSecurity/hardening roadmap tracked in HARDENING.md; feature roadmap surfaced via GitHub Issues with the feature label.","documentation_architecture_status":"Met","documentation_architecture_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/ARCHITECTURE.md\r\n\r\nTop-level actors / actions / trust-boundaries diagram + deeper component designs under docs/design/.","documentation_security_status":"Met","documentation_security_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/SECURITY.md\r\n\r\nThreat model + supported-version scope + disclosure cadence + verification commands.","documentation_quick_start_status":"Met","documentation_quick_start_justification":"URL: https://docs.simple-container.com/getting-started/quick-start/\r\n\r\nPublished quick-start on the docs site.","documentation_current_status":"Met","documentation_current_justification":"CONTRIBUTING.md requires docs updates as part of any change that touches user-visible behaviour. Documentation defects are tracked as standard issues.","documentation_achievements_status":"Met","documentation_achievements_justification":"URL: https://github.com/simple-container-com/api/blob/main/README.md\r\n\r\nREADME hyperlinks Scorecard, OpenSSF Best Practices, OpenSSF Baseline, CodeQL, Semgrep, SLSA Build L3, Sigstore-signed, Go Report Card, and License badges.","accessibility_best_practices_status":"Met","accessibility_best_practices_justification":"Docs site uses MkDocs Material, which follows WCAG 2.1 AA practices by default; README + CONTRIBUTING are plain-markdown screen-reader-friendly text.","internationalization_status":"N/A","internationalization_justification":"CLI tool with English error messages; no human-facing internationalised text.","sites_password_security_status":"N/A","sites_password_security_justification":"Project sites do not store user passwords; auth is delegated to GitHub OAuth / Cloudflare / etc.","maintenance_or_update_status":"Met","maintenance_or_update_justification":"Simple Container is a rolling-release product with calver tags YYYY.M.X; we do not maintain older minor branches. The upgrade path is to re-run the install bootstrap: curl -s \"https://dist.simple-container.com/sc.sh\" | bash (replaces the local sc binary; signature-verified via cosign). Breaking changes are called out in the per-release notes at https://github.com/simple-container-com/api/releases.","vulnerability_report_credit_status":"N/A","vulnerability_report_credit_justification":"No externally-reported vulnerabilities have been resolved in the last 12 months. Should one be published, credit will be given in the corresponding GitHub Security Advisory at https://github.com/simple-container-com/api/security/advisories per the process documented in docs/SECURITY.md.","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"Documented in docs/SECURITY.md — reporting channels (GitHub Security Advisory preferred; security@ / direct email fallback), triage SLA, fix-and-disclose flow, advisory publication, and credit policy.\r\n\r\nURL: https://github.com/simple-container-com/api/blob/main/docs/SECURITY.md","coding_standards_status":"Met","coding_standards_justification":"Primary language is Go; we follow the standard Go style guide (gofmt, go vet, staticcheck, Effective Go) as enforced by golangci-lint. Configuration is at .golangci.yml. Contribution rules in docs/CONTRIBUTING.md require PRs to pass these checks before merge.\r\n\r\nURLs: https://go.dev/doc/effective_go and https://github.com/simple-container-com/api/blob/main/.golangci.yml\r\n","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"gofmt, go vet, and golangci-lint run as required CI checks in .github/workflows/build-staging.yml on every PR, and branch protection on main blocks merge until they pass.","build_standard_variables_status":"N/A","build_standard_variables_justification":"The product is built with the Go toolchain, which does not consume CC / CFLAGS / CXX / CXXFLAGS / LDFLAGS in the C-compiler sense. Build flags are passed via the Go toolchain's own conventions (-ldflags, -trimpath, GOFLAGS) and are configured in the welder build descriptor.","build_preserve_debug_status":"N/A","build_preserve_debug_justification":"The Go toolchain's release builds intentionally strip path information via -trimpath to produce reproducible binaries; symbol tables are retained by default (we do not pass -ldflags='-s -w' in release builds). There is no separate \"install\" step that would strip debug info.","build_non_recursive_status":"N/A","build_non_recursive_justification":"Go modules drive the build; there is no recursive make over subdirectories. go build resolves the full dependency graph from go.mod + go.sum in a single invocation.\r\n\r\n","build_repeatable_status":"Met","build_repeatable_justification":" Go build reproducibility: go.sum hashes all transitive deps, the build uses -trimpath to strip filesystem prefixes, the toolchain version is pinned in go.mod's go directive, base images are SHA-digest-pinned. Released binaries carry SLSA Build L3 provenance (via attest-build-provenance@v4) and a CycloneDX SBOM, so a verifier can rebuild from the recorded inputs.","installation_standard_variables_status":"Met","installation_standard_variables_justification":"sc.sh installs to /usr/local/bin/sc by default and honors the SC_INSTALL_DIR environment variable for non-standard destinations. The install path is logged at the end of the bootstrap run.","installation_development_quick_status":"Met","installation_development_quick_justification":"docs/CONTRIBUTING.md [osps_do_07_01]","external_dependencies_status":"Met","external_dependencies_justification":"Multiple machine-readable manifests, all in the public repo:\r\nGo runtime deps: go.mod + go.sum (cryptographic hashes for every direct and transitive module)\r\nPython docs deps: docs/requirements.in (sources) + docs/requirements.txt (pip-compile output with --generate-hashes)\r\nContainer base images: Dockerfiles pin by SHA digest\r\nGitHub Actions: SHA-pinned in every workflow under .github/workflows/\r\nPer-release CycloneDX SBOM: attached as .sbom.cdx.json sidecar to every Release artifact (the canonical machine-readable inventory of what shipped)\r\nPolicy: https://github.com/simple-container-com/api/blob/main/docs/DEPENDENCIES.md","dependency_monitoring_status":"Met","dependency_monitoring_justification":"Every change is automatically evaluated against the documented SCA policy in docs/DEPENDENCIES.md (\"Pre-release SCA gate\" + \"Suppressing a finding\") [osps_vm_05_03]","updateable_reused_components_status":"Met","updateable_reused_components_justification":"[osps_qa_02_01]","interfaces_current_status":"Met","interfaces_current_justification":"Go deprecation warnings surface as staticcheck SA1019 findings in CI (golangci-lint config at .golangci.yml). Recent example: fix(deps): migrate aws-sdk-go v1 → v2 (commit on main, 2026-05-18) replaced the legacy AWS SDK with its non-deprecated successor across the codebase as part of vulnerability remediation. Deprecated GitHub Actions are surfaced by Dependabot and SHA-pinned only after confirming a non-deprecated alternative.","automated_integration_testing_status":"Met","automated_integration_testing_justification":"[test_continuous_integration] [osps_qa_06_01]","regression_tests_added50_status":"Met","regression_tests_added50_justification":"Bug-fix PRs that touch a code path with existing unit tests extend or add cases to that suite; fixes to the security-critical HMAC parse path are covered by the Go-native fuzz target at pkg/security/cache_fuzz_test.go which runs in CI on every PR (.github/workflows/fuzz.yml). Pure CI / packaging / dependency-bump fixes do not have a test-suite equivalent and are validated by the rebuild + reachability scan (govulncheck reachability-aware gate per .github/workflows/govulncheck.yml) instead.","test_statement_coverage80_status":"Met","test_statement_coverage80_justification":"go test","test_policy_mandated_status":"Met","test_policy_mandated_justification":"[tests_documented_added] [osps_qa_06_03]","implement_secure_design_status":"Met","implement_secure_design_justification":"Documented in docs/SECURITY.md (STRIDE threat model + V1-V5 attack vectors) and docs/ARCHITECTURE.md (trust-boundary diagram). Concrete applications:\r\n\r\nMinimise attack surface: single static binary; no plugins, no eval, no shell-out paths from untrusted input.\r\nDefense in depth: install bootstrap layers SHA256 → cosign keyless signature → SLSA Build L3 provenance verification before executing the binary.\r\nFail-safe defaults: signature-verification failure aborts install; no silent downgrade.\r\nLeast privilege: every CI workflow declares permissions: explicitly and starts from read-all, upgrading per-job; secrets injected via env, never embedded.\r\nSeparation of trust boundaries: each external edge (dist.simple-container.com, GitHub, cloud APIs) is explicit in the architecture diagram with the controls applied to it.","input_validation_status":"Met","input_validation_justification":"Untrusted inputs:\r\n\r\nCLI arguments: validated by cobra command framework with explicit type / choice constraints.\r\nYAML config (cfg.yaml, secret configs): parsed strict-mode (unknown keys rejected).\r\nCache entries: HMAC-verified before deserialization (pkg/security/cache.go); the parse path is fuzz-tested (pkg/security/cache_fuzz_test.go).\r\nCloud API responses: validated by the official AWS/GCP/Azure/Kubernetes SDKs.\r\nNo raw eval, no shell-injection sinks, no string-concat SQL.","crypto_algorithm_agility_status":"Met","crypto_algorithm_agility_justification":"The codebase exercises multiple modern primitives concurrently: RSA-OAEP-SHA256 and ed25519+ChaCha20-Poly1305 for secrets encryption (the user picks which), HMAC-SHA256 for cache MAC (switchable to SHA-384/512 via Go stdlib hash.Hash interface — one-line change), Sigstore artifact signing (algorithm controlled by Fulcio, currently ECDSA P-256). All Go stdlib primitives are interchangeable through the hash.Hash / cipher.AEAD interfaces.","crypto_credential_agility_status":"Met","crypto_credential_agility_justification":"SC never embeds credentials in code. Cloud credentials live in user-managed secret stores referenced from cfg.yaml (env vars, AWS Secrets Manager paths, file paths). Rotation = update the secret store; no rebuild. The HMAC cache key is auto-generated to .hmac.key (mode 0600) on first use and can be regenerated by deleting the file. CI tokens for the project itself live as GitHub Actions secrets, rotable via the GitHub admin UI.","signed_releases_status":"Met","signed_releases_justification":"SECURITY.md cosign-verify-blob block — the --certificate-identity-regexp is anchored to https://github.com/simple-container-com/api/.github/workflows/push.yaml@refs/heads/main, which IS the authoring identity (the production publish workflow). --certificate-oidc-issuer pins to GitHub Actions OIDC. The Sigstore Rekor entry records this identity in a public transparency log. [osps_do_03_02]","version_tags_signed_status":"Met","version_tags_signed_justification":"Every release tag is materialised in a GitHub Release with cosign keyless signatures attached as .sigstore.json + .cosign-bundle sidecars per platform binary, plus SHA256 checksum and CycloneDX SBOM. The Sigstore transparency-log entry (Rekor) is the verifiable cryptographic anchor — the git tag itself doesn't need a GPG signature because the artifact-level Sigstore signature is the stronger guarantee.\r\n\r\nURL: https://github.com/simple-container-com/api/releases","badge_percentage_2":100,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"URL: https://github.com/simple-container-com/api/blob/main/docs/MAINTAINERS.md#sensitive-resource-access-map\r\n\r\nThree active maintainers with merge access (per current git shortlog of main).","copyright_per_file_status":"Met","copyright_per_file_justification":"Every hand-written .go source file carries a per-file copyright notice `// Copyright (c) Simple Container` (year-less by design so it never needs an annual bump; 551 files), added in PR #335 and ENFORCED on every PR by the golangci-lint `goheader` linter (a file missing the header fails CI). Auto-generated mocks under pkg/**/mocks/ carry the generator header and are excluded.","license_per_file_status":"Met","license_per_file_justification":"Every hand-written .go source file carries `// SPDX-License-Identifier: MIT` (551 files), matching the root MIT LICENSE, added in PR #335 and enforced by the golangci-lint `goheader` linter on every PR. Generated mocks under pkg/**/mocks/ are excluded (regenerated).","small_tasks_status":"Met","small_tasks_justification":"Small, well-scoped tasks for new contributors are labelled `good first issue`: https://github.com/simple-container-com/api/issues?q=is:open+is:issue+label:\"good first issue\"","require_2FA_status":"Met","require_2FA_justification":"GitHub requires 2FA as of March 2023. [osps_ac_01_01]","secure_2FA_status":"Met","secure_2FA_justification":"only passkeys","code_review_standards_status":"Met","code_review_standards_justification":"Code-review requirements are documented at https://github.com/simple-container-com/api/blob/main/docs/CONTRIBUTING.md (code review required; branch protection enforces a 1-reviewer minimum; an LLM-driven pre-merge pass via the public OpenAI Codex / Google Gemini CLIs on larger PRs; security-sensitive changes under pkg/security, push.yaml, sc.sh pull in additional reviewers + human security review) and https://github.com/simple-container-com/api/blob/main/docs/MAINTAINERS.md (consensus via PR review; path-scoped ownership via .github/CODEOWNERS). Enforced by branch protection: signed commits, review approval, green checks, DCO.\r\n","two_person_review_status":"Met","two_person_review_justification":"Branch protection on main requires required approving review count: 1. GitHub branch protection does not count the PR author's own approval toward this requirement — only non-author approvals are accepted. Verified via Scorecard Branch-Protection check: codeowner review is required on main, last push approval is required to merge on branch main. [osps_qa_07_01]","test_statement_coverage90_status":"Met","test_statement_coverage90_justification":"Go's `go test -coverprofile` measures statement coverage. The unit suite provides 90.3% statement coverage on the documented measurement scope (the unit-testable core), computed by `welder run coverage` + .github/workflows/coverage.yml on every PR/push. Scope + per-row-justified exclusions: https://github.com/simple-container-com/api/blob/main/docs/TESTING.md#coverage-scope . Delivered in PR #332 (merged). Full-repo unfiltered coverage (27.6%) also reported.","test_branch_coverage80_status":"N/A","test_branch_coverage80_justification":"N/A for Go: standard FLOSS tooling (`go test -cover`/`-covermode=atomic`) measures statement coverage, not branch coverage, and there is no widely-used FLOSS branch-coverage tool for Go. Statement coverage is 90.3% on the documented scope, via table-driven tests exercising both success and error branches.","security_review_status":"Met","security_review_justification":"docs/SECURITY.md carries the STRIDE threat model + attack vectors V1–V5 (compromised CDN, signing-identity rotation, etc.). Reviewers (codex + gemini) run on every security-leaning PR — see commit history for evidence. [osps_sa_03_01]","assurance_case_status":"Met","assurance_case_justification":" The assurance case is the combined contents of:\r\n\r\nThreat model: docs/SECURITY.md (STRIDE table + attack vectors V1-V5 + responsible-disclosure channels)\r\nTrust boundaries: docs/ARCHITECTURE.md (mermaid trust-boundary diagram + actors + data flows)\r\nSecure design principles argument: docs/SECURITY.md defence-in-depth + least-privilege + fail-safe-defaults sections\r\nCommon implementation weaknesses countered: CodeQL (Go), Semgrep custom rules, golangci-lint with gosec, govulncheck reachability-aware gate, OpenVEX-only suppressions per docs/DEPENDENCIES.md\r\nURL (entry point with cross-refs to all the above): https://github.com/simple-container-com/api/blob/main/docs/SECURITY.md","achieve_passing_status":"Met","achieve_silver_status":"Met","tiered_percentage":300,"repo_url_updated_at":null,"achieved_silver_at":"2026-05-18T20:38:40.767Z","lost_silver_at":null,"achieved_gold_at":"2026-06-21T12:10:40.938Z","lost_gold_at":null,"first_achieved_passing_at":"2026-05-18T19:07:49.591Z","first_achieved_silver_at":"2026-05-18T20:38:40.767Z","first_achieved_gold_at":"2026-06-21T12:10:40.938Z","maintained_status":"Met","OSPS-AC-01.01_status":"Met","OSPS-AC-01.01_justification":"GitHub requires 2FA as of March 2023.","OSPS-AC-02.01_status":"Met","OSPS-AC-03.01_status":"Met","OSPS-AC-03.02_status":"Met","OSPS-BR-01.01_status":"Met","OSPS-BR-01.02_status":3,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"Met","OSPS-BR-03.01_justification":"Project URLs use HTTPS exclusively.","OSPS-BR-03.02_status":"Met","OSPS-BR-03.02_justification":"Distribution channels use HTTPS exclusively.","OSPS-BR-07.01_status":"Met","OSPS-BR-07.01_justification":"[no_leaked_credentials]","OSPS-DO-01.01_status":"Met","OSPS-DO-01.01_justification":"Some documentation basics file contents found. [documentation_basics]","OSPS-DO-02.01_status":"Met","OSPS-DO-02.01_justification":"GitHub provides defect reporting mechanisms by default (via issues). [osps_do_02_01] [report_process]","OSPS-GV-02.01_status":"Met","OSPS-GV-02.01_justification":"GitHub supports public discussions on proposed changes (via pull requests) and usage obstacles (via issues).","OSPS-GV-03.01_status":"Met","OSPS-GV-03.01_justification":"Projects on GitHub by default use issues and pull requests, as encouraged by documentation such as \u003chttps://guides.github.com/activities/contributing-to-open-source/\u003e. [contribution]","OSPS-LE-02.01_status":"Met","OSPS-LE-02.01_justification":"The MIT license for the repository contents is approved by the Open Source Initiative (OSI).","OSPS-LE-02.02_status":"Met","OSPS-LE-02.02_justification":"The MIT license is approved by the Open Source Initiative (OSI). [floss_license]","OSPS-LE-03.01_status":"Met","OSPS-LE-03.01_justification":"License file found in repository.","OSPS-LE-03.02_status":"Met","OSPS-LE-03.02_justification":"Non-trivial license location file in repository: \u003chttps://github.com/simple-container-com/api/blob/main/LICENSE\u003e. [license_location]","OSPS-QA-01.01_status":"Met","OSPS-QA-01.01_justification":"Repository is publicly available on GitHub.","OSPS-QA-01.02_status":"Met","OSPS-QA-01.02_justification":"Repository git metadata is publicly available on GitHub.","OSPS-QA-02.01_status":"Met","OSPS-QA-04.01_status":"Met","OSPS-QA-05.01_status":"Met","OSPS-QA-05.02_status":"Met","OSPS-VM-02.01_status":"Met","OSPS-AC-04.01_status":"Met","OSPS-BR-02.01_status":"Met","OSPS-BR-02.01_justification":"calver is used [version_unique]","OSPS-BR-04.01_status":"Met","OSPS-BR-04.01_justification":"No release notes file found. [release_notes]","OSPS-BR-05.01_status":"Met","OSPS-BR-05.01_justification":"go modules / pip / npm / SHA-pinned Docker / SHA-pinned Actions","OSPS-BR-06.01_status":"Met","OSPS-BR-06.01_justification":"covered by per-asset cosign + SHA256 + SLSA bundle","OSPS-DO-06.01_status":"Met","OSPS-DO-06.01_justification":"docs/DEPENDENCIES.md","OSPS-GV-01.01_status":"Met","OSPS-GV-01.01_justification":"docs/MAINTAINERS.md","OSPS-GV-01.02_status":"Met","OSPS-GV-01.02_justification":"docs/MAINTAINERS.md","OSPS-GV-03.02_status":"Met","OSPS-GV-03.02_justification":"docs/CONTRIBUTING.md","OSPS-LE-01.01_status":"Met","OSPS-LE-01.01_justification":".github/workflows/dco.yml enforces a Signed-off-by: trailer on every commit in every PR (the Developer Certificate of Origin). Branch protection additionally enforces signed commits (SSH/GPG).","OSPS-QA-03.01_status":"Met","OSPS-QA-03.01_justification":"[test_continuous_integration]","OSPS-QA-06.01_status":"Met","OSPS-QA-06.01_justification":"[test_continuous_integration]","OSPS-SA-01.01_status":"Met","OSPS-SA-01.01_justification":"See docs/ARCHITECTURE.md for actors, actions, trust boundaries, and the high-level data-flow diagram. Detailed component designs live in docs/design/ (cloud-api system architecture, container-security component design, plus dated feature-design records under docs/design/YYYY-MM-DD/","OSPS-SA-02.01_status":"Met","OSPS-SA-02.01_justification":"https://docs.simple-container.com/ [documentation_interface]","OSPS-SA-03.01_status":"Met","OSPS-SA-03.01_justification":"docs/SECURITY.md carries the STRIDE threat model + attack vectors V1–V5 (compromised CDN, signing-identity rotation, etc.). Reviewers (codex + gemini) run on every security-leaning PR — see commit history for evidence.","OSPS-VM-01.01_status":"Met","OSPS-VM-01.01_justification":"[vulnerability_report_response]","OSPS-VM-03.01_status":"Met","OSPS-VM-03.01_justification":"docs/SECURITY.md documents three channels in preference order: GitHub Security Advisory (private to maintainers, integrates with CVE issuance), security@simple-container.com group alias, creed@simple-container.com direct path. All three reach maintainers without requiring a public issue.","OSPS-VM-04.01_status":"Met","OSPS-VM-04.01_justification":"Fixed vulnerabilities are disclosed via GitHub Security Advisories on simple-container-com/api, which become publicly readable + included in GitHub's advisory database after fix is shipped. docs/SECURITY.md documents the 90-day default disclosure window + earlier disclosure if a CVE is already public elsewhere","OSPS-AC-04.02_status":"Met","OSPS-AC-04.02_justification":"Root permissions: is contents: read. Per-job write grants only on docker-finalize (needs write for tag-release + Release create), publish-sc-preview (write for preview tag publish), publish-git-tag (write for tag push). Scorecard Token-Permissions = 10/10","OSPS-BR-02.02_status":"Met","OSPS-BR-02.02_justification":"calver is used [version_unique]","OSPS-BR-07.02_status":"Met","OSPS-BR-07.02_justification":"docs/SECRETS-POLICY.md documents: secret storage (GitHub Actions encrypted secrets only, never committed); access control (per-job permissions: block, no org-wide secrets); rotation cadence (CI tokens 90-day; cloud provider keys quarterly; on-incident immediate); leak detection (TruffleHog scans every PR diff; GitHub secret-scanning push-protection enabled).","OSPS-DO-03.01_status":"Met","OSPS-DO-03.01_justification":"docs/SECURITY.md \"Verifying tarballs\" + \"Verifying images\" sections contain the sha256sum -c + cosign verify-blob --bundle + gh attestation verify command lines with the exact identity regex. Mirrored in docs/RELEASES.md \"Reading a release for security implications\"","OSPS-DO-03.02_status":"Met","OSPS-DO-03.02_justification":"SECURITY.md cosign-verify-blob block — the --certificate-identity-regexp is anchored to https://github.com/simple-container-com/api/.github/workflows/push.yaml@refs/heads/main, which IS the authoring identity (the production publish workflow). --certificate-oidc-issuer pins to GitHub Actions OIDC. The Sigstore Rekor entry records this identity in a public transparency log.","OSPS-DO-04.01_status":"Met","OSPS-DO-04.01_justification":"SECURITY.md \"Supported versions\" already says \"most recent calver release\" supported; tightening to: each vYYYY.M.x release supported for security fixes until the next minor (vYYYY.M.x+1) ships. Back-ports only for HIGH/CRIT and only to the latest vYYYY.M.x line. No LTS branch model — calver releases ship on every main merge so the \"supported\" version moves continuously.","OSPS-DO-05.01_status":"Met","OSPS-DO-05.01_justification":"SECURITY.md \"End-of-life\" section: a release is EOL the moment the next vYYYY.M.x ships (calver advances on every main merge, so practically: the previous release stops receiving security back-ports). Consumers MUST pin to a recent release or a SHA and update at least monthly. Older releases receive no security patches.","OSPS-GV-04.01_status":"Met","OSPS-GV-04.01_justification":"MAINTAINERS.md \"Promoting a contributor\" section","OSPS-QA-02.02_status":"Met","OSPS-QA-02.02_justification":"Every published tarball + container image ships a CycloneDX SBOM sidecar","OSPS-QA-04.02_status":"N/A","OSPS-QA-04.02_justification":"Production releases (the sc CLI tarballs + Docker images) are built from a single repository — simple-container-com/api. Shared infra in simple-container-com/actions provides composite actions but does not produce a release of its own; it is consumed by api's release pipeline. No release \"comprises multiple source-code repositories\" in the Baseline sense.","OSPS-QA-06.02_status":"Met","OSPS-QA-06.02_justification":"[test]","OSPS-QA-06.03_status":"Met","OSPS-QA-06.03_justification":"[tests_documented_added]","OSPS-QA-07.01_status":"Met","OSPS-QA-07.01_justification":"Branch protection on main requires required approving review count: 1. GitHub branch protection does not count the PR author's own approval toward this requirement — only non-author approvals are accepted. Verified via Scorecard Branch-Protection check: codeowner review is required on main, last push approval is required to merge on branch main.","OSPS-SA-03.02_status":"Met","OSPS-SA-03.02_justification":"docs/SECURITY.md carries the STRIDE threat model + attack vectors V1–V5 (compromised CDN, signing-identity rotation, malicious dep upgrade, CI-runner exploit, end-user MITM). ","OSPS-VM-04.02_status":"Met","OSPS-VM-04.02_justification":"OpenVEX document at vex/openvex.json","OSPS-VM-05.01_status":"Met","OSPS-VM-05.01_justification":"docs/DEPENDENCIES.md \"Remediation thresholds\" section now states: CRITICAL/HIGH within 30 days, MEDIUM within 90 days, LOW best-effort. ","OSPS-VM-05.02_status":"Met","OSPS-VM-05.02_justification":"Pre-release SCA gate\" section: production releases auto-cut on every merge to main, so pre-release ≡ pre-merge. Gate runs govulncheck + CodeQL + Semgrep + TruffleHog + Dependabot + Trivy/Grype on every PR + push.","OSPS-VM-05.03_status":"Met","OSPS-VM-05.03_justification":"Every change is automatically evaluated against the documented SCA policy in docs/DEPENDENCIES.md (\"Pre-release SCA gate\" + \"Suppressing a finding\")","OSPS-VM-06.01_status":"Met","OSPS-VM-06.01_justification":"[static_analysis_fixed]","OSPS-VM-06.02_status":"Met","OSPS-VM-06.02_justification":"semgrep + CodeQL [static_analysis]","badge_percentage_baseline_1":100,"badge_percentage_baseline_2":100,"badge_percentage_baseline_3":100,"achieved_baseline_1_at":"2026-05-18T17:52:36.177Z","achieved_baseline_2_at":"2026-05-18T18:08:15.456Z","achieved_baseline_3_at":"2026-05-18T18:57:06.194Z","lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":"2026-05-18T17:52:36.177Z","first_achieved_baseline_2_at":"2026-05-18T18:08:15.456Z","first_achieved_baseline_3_at":"2026-05-18T18:57:06.194Z","baseline_tiered_percentage":300,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":true,"baseline_2_saved":true,"baseline_3_saved":true,"OSPS-BR-01.03_status":"Met","OSPS-DO-07.01_status":"Met","OSPS-DO-07.01_justification":"docs/CONTRIBUTING.md","OSPS-BR-01.04_status":"Met","OSPS-BR-01.04_justification":"branch-preview.yaml is the only workflow that accepts workflow_dispatch inputs (a branch ref). The ref is validated by GitHub's own ref-format checking + used in safe contexts (checkout ref:, never shell-interpolated). PR-triggered workflows use pull_request (not pull_request_target) so attacker PRs can't read secrets. push.yaml explicitly rejects non-main refs (exit 1 early-guard) to prevent re-dispatch.","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"gold","additional_rights":[],"project_entry_attribution":"Please credit Dmitriy Creed and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"}