Data

Tools

Indexes

Applications

Experiments

Repos

An open API service providing repository metadata for many open source software ecosystems.

processing

⚠️ Processing moved to processing/processing4 ⚠️

OpenSSF Scorecard report

3.4

Overall Score

10/10 Critical Risk
23/70 High Risk
0/40 Medium Risk
9/20 Low Risk
Generated on August 11, 2025 | Scorecard vv5.2.1-40-gf6ed084d
Security Checks
10/10
Dangerous-Workflow
Critical Risk

no dangerous workflow patterns detected

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10/10
Token-Permissions
High Risk

GitHub workflow tokens follow principle of least privilege

Determines if the project's workflows follow the principle of least privilege.

Show details
ℹ️ Info: topLevel 'contents' permission set to 'read': .github/workflows/lock.yml:8
ℹ️ Info: no jobLevel write permissions found
10/10
Vulnerabilities
High Risk

0 existing vulnerabilities detected

Determines if the project has open, known unfixed vulnerabilities.

9/10
License
Low Risk

license file detected

Determines if the project has defined a license.

Show details
ℹ️ Info: project has a license file: license.txt:0
⚠️ Warn: project license file does not contain an FSF or OSI license.
3/10
Code-Review
High Risk

Found 8/23 approved changesets -- score normalized to 3

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0/10
Binary-Artifacts
High Risk

binaries present in source code

Determines if the project has generated executable (binary) artifacts in the source repository.

Show details
⚠️ Warn: binary detected: app/lib/ant-launcher.jar:1
⚠️ Warn: binary detected: app/lib/ant.jar:1
⚠️ Warn: binary detected: app/lib/jna-platform.jar:1
⚠️ Warn: binary detected: app/lib/jna.jar:1
⚠️ Warn: binary detected: app/test/lib/junit-4.8.1.jar:1
⚠️ Warn: binary detected: build/macosx/appbundler.jar:1
⚠️ Warn: binary detected: build/shared/tools/MovieMaker/tool/jai_imageio.jar:1
⚠️ Warn: binary detected: core/apple.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-linux-aarch64.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-linux-amd64.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-linux-armv6hf.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-linux-i586.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-macosx-universal.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-windows-amd64.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt-natives-windows-i586.jar:1
⚠️ Warn: binary detected: core/library/gluegen-rt.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-linux-aarch64.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-linux-amd64.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-linux-armv6hf.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-linux-i586.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-macosx-universal.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-windows-amd64.jar:1
⚠️ Warn: binary detected: core/library/jogl-all-natives-windows-i586.jar:1
⚠️ Warn: binary detected: core/library/jogl-all.jar:1
⚠️ Warn: binary detected: core/src/japplemenubar/libjAppleMenuBar.jnilib:1
⚠️ Warn: binary detected: java/application/launch4j/bin/ld-linux:1
⚠️ Warn: binary detected: java/application/launch4j/bin/ld-linux-armv6hf:1
⚠️ Warn: binary detected: java/application/launch4j/bin/ld-macosx:1
⚠️ Warn: binary detected: java/application/launch4j/bin/ld-windows.exe:1
⚠️ Warn: binary detected: java/application/launch4j/bin/windres-linux:1
⚠️ Warn: binary detected: java/application/launch4j/bin/windres-linux-armv6hf:1
⚠️ Warn: binary detected: java/application/launch4j/bin/windres-macosx:1
⚠️ Warn: binary detected: java/application/launch4j/bin/windres-windows.exe:1
⚠️ Warn: binary detected: java/application/launch4j/head/consolehead.o:1
⚠️ Warn: binary detected: java/application/launch4j/head/guihead.o:1
⚠️ Warn: binary detected: java/application/launch4j/head/head.o:1
⚠️ Warn: binary detected: java/application/launch4j/launch4j.jar:1
⚠️ Warn: binary detected: java/application/launch4j/lib/xstream.jar:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/crt2.o:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libadvapi32.a:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libgcc.a:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libkernel32.a:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libmingw32.a:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libmsvcrt.a:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libshell32.a:1
⚠️ Warn: binary detected: java/application/launch4j/w32api/libuser32.a:1
⚠️ Warn: binary detected: java/application/template.app/Contents/MacOS/JavaApplicationStub:1
⚠️ Warn: binary detected: java/libraries/dxf/dxfviewer.jar:1
⚠️ Warn: binary detected: java/libraries/io/library/linux-arm64/libprocessing-io.so:1
⚠️ Warn: binary detected: java/libraries/io/library/linux-armv6hf/libprocessing-io.so:1
⚠️ Warn: binary detected: java/libraries/io/library/linux32/libprocessing-io.so:1
⚠️ Warn: binary detected: java/libraries/io/library/linux64/libprocessing-io.so:1
⚠️ Warn: binary detected: java/libraries/pdf/library/itext.jar:1
⚠️ Warn: binary detected: java/libraries/serial/library/jssc.jar:1
⚠️ Warn: binary detected: java/libraries/serial/library/linux-arm64/libjSSC-2.8.so:1
⚠️ Warn: binary detected: java/libraries/serial/library/linux-armv6hf/libjSSC-2.8.so:1
⚠️ Warn: binary detected: java/libraries/serial/library/linux32/libjSSC-2.8.so:1
⚠️ Warn: binary detected: java/libraries/serial/library/linux64/libjSSC-2.8.so:1
⚠️ Warn: binary detected: java/libraries/serial/library/macosx/libjSSC-2.8.jnilib:1
⚠️ Warn: binary detected: java/libraries/serial/library/windows32/jSSC-2.8.dll:1
⚠️ Warn: binary detected: java/libraries/serial/library/windows64/jSSC-2.8.dll:1
⚠️ Warn: binary detected: java/libraries/svg/library/batik-awt-util-1.8.jar:1
⚠️ Warn: binary detected: java/libraries/svg/library/batik-dom-1.8.jar:1
⚠️ Warn: binary detected: java/libraries/svg/library/batik-ext-1.8.jar:1
⚠️ Warn: binary detected: java/libraries/svg/library/batik-svggen-1.8.jar:1
⚠️ Warn: binary detected: java/libraries/svg/library/batik-util-1.8.jar:1
⚠️ Warn: binary detected: java/libraries/svg/library/batik-xml-1.8.jar:1
⚠️ Warn: binary detected: java/mode/antlr.jar:1
⚠️ Warn: binary detected: java/mode/classpath-explorer-1.0.jar:1
⚠️ Warn: binary detected: java/mode/com.ibm.icu.jar:1
⚠️ Warn: binary detected: java/mode/jdi.jar:1
⚠️ Warn: binary detected: java/mode/jdimodel.jar:1
⚠️ Warn: binary detected: java/mode/jdtCompilerAdapter.jar:1
⚠️ Warn: binary detected: java/mode/jsoup-1.7.1.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.core.contenttype.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.core.jobs.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.core.resources.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.core.runtime.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.equinox.common.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.equinox.preferences.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.jdt.core.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.osgi.jar:1
⚠️ Warn: binary detected: java/mode/org.eclipse.text.jar:1
⚠️ Warn: binary detected: java/mode/org.netbeans.swing.outline.jar:1
0/10
Branch-Protection
High Risk

branch protection not enabled on development/release branches

Determines if the default and release branches are protected with GitHub's branch protection settings.

Show details
⚠️ Warn: branch protection not enabled for branch 'master'
0/10
CII-Best-Practices
Low Risk

no effort to earn an OpenSSF best practices badge detected

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0/10
Fuzzing
Medium Risk

project is not fuzzed

Determines if the project uses fuzzing.

Show details
⚠️ Warn: no fuzzer integrations found
0/10
Maintained
High Risk

0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0

Determines if the project is "actively maintained".

0/10
Pinned-Dependencies
Medium Risk

dependency not pinned by hash detected -- score normalized to 0

Determines if the project has declared and pinned the dependencies of its build process.

Show details
⚠️ Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/processing/processing/lock.yml/master?enable=pin
ℹ️ Info: 0 out of 1 third-party GitHubAction dependencies pinned
0/10
SAST
Medium Risk

SAST tool is not run on all commits -- score normalized to 0

Determines if the project uses static code analysis.

Show details
⚠️ Warn: 0 commits out of 15 are checked with a SAST tool
0/10
Security-Policy
Medium Risk

security policy file not detected

Determines if the project has published a security policy.

Show details
⚠️ Warn: no security policy file detected
⚠️ Warn: no security file to analyze
⚠️ Warn: no security file to analyze
⚠️ Warn: no security file to analyze
0/10
Signed-Releases
High Risk

Project has not signed or included provenance with any releases.

Determines if the project cryptographically signs release artifacts.

Show details
⚠️ Warn: release artifact processing-0270-3.5.4 not signed: https://api.github.com/repos/processing/processing/releases/22933118
⚠️ Warn: release artifact processing-0269-3.5.3 not signed: https://api.github.com/repos/processing/processing/releases/15340687
⚠️ Warn: release artifact processing-0268-3.5.2 not signed: https://api.github.com/repos/processing/processing/releases/15123766
⚠️ Warn: release artifact processing-0267-3.5.1 not signed: https://api.github.com/repos/processing/processing/releases/15089922
⚠️ Warn: release artifact processing-0266-3.5 not signed: https://api.github.com/repos/processing/processing/releases/15076792
⚠️ Warn: release artifact processing-0270-3.5.4 does not have provenance: https://api.github.com/repos/processing/processing/releases/22933118
⚠️ Warn: release artifact processing-0269-3.5.3 does not have provenance: https://api.github.com/repos/processing/processing/releases/15340687
⚠️ Warn: release artifact processing-0268-3.5.2 does not have provenance: https://api.github.com/repos/processing/processing/releases/15123766
⚠️ Warn: release artifact processing-0267-3.5.1 does not have provenance: https://api.github.com/repos/processing/processing/releases/15089922
⚠️ Warn: release artifact processing-0266-3.5 does not have provenance: https://api.github.com/repos/processing/processing/releases/15076792
N/A
Packaging
Not Applicable

packaging workflow not detected

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

Show details
⚠️ Warn: no GitHub/GitLab publishing workflow detected.
Links
Repository Details
  • Stars 6,496
  • Forks 1,476
  • Open issues 495
  • License other
  • Language Java
  • Size 1.53 GB
  • Created at about 13 years ago
  • Updated at 12 days ago
  • Pushed at 11 months ago
  • Last synced at 5 days ago
  • Dependencies parsed at Pending
Commit Stats
  • Commits 12076
  • Authors 141
  • Mean commits per author 85.65
  • DDS 0.513
  • More commit stats
Funding
https://github.com/sponsors/processing, https://processingfoundation.org