{"id":13468362,"url":"https://github.com/coreruleset/coreruleset","last_synced_at":"2026-01-14T14:36:12.866Z","repository":{"id":37002000,"uuid":"263610232","full_name":"coreruleset/coreruleset","owner":"coreruleset","description":"OWASP CRS (Official Repository)","archived":false,"fork":false,"pushed_at":"2026-01-11T23:02:59.000Z","size":11974,"stargazers_count":2940,"open_issues_count":122,"forks_count":435,"subscribers_count":57,"default_branch":"main","last_synced_at":"2026-01-11T23:07:26.666Z","etag":null,"topics":["crs","owasp","ruleset","security","waf"],"latest_commit_sha":null,"homepage":"https://coreruleset.org","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coreruleset.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGES.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"custom":"https://owasp.org/donate/?reponame=www-project-modsecurity-core-rule-set\u0026title=OWASP+CRS"}},"created_at":"2020-05-13T11:28:52.000Z","updated_at":"2026-01-11T15:52:41.000Z","dependencies_parsed_at":"2023-09-24T05:56:53.174Z","dependency_job_id":"a642e4cf-96f4-45a3-aec3-a0b14b27abf5","html_url":"https://github.com/coreruleset/coreruleset","commit_stats":null,"previous_names":[],"tags_count":65,"template":false,"template_full_name":null,"purl":"pkg:github/coreruleset/coreruleset","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fcoreruleset","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fcoreruleset/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fcoreruleset/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fcoreruleset/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coreruleset","download_url":"https://codeload.github.com/coreruleset/coreruleset/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coreruleset%2Fcoreruleset/sbom","scorecard":{"id":304852,"data":{"date":"2025-08-11","repo":{"name":"github.com/coreruleset/coreruleset","commit":"533fdef58124c3ebe0e70a1fcb3c2a88eeb1cf2f"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.3,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":0,"reason":"dangerous workflow patterns detected","details":["Warn: script injection with untrusted input ' github.head_ref ': .github/workflows/lint.yaml:62","Warn: script injection with untrusted input ' github.head_ref ': .github/workflows/lint.yaml:62"],"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/check-pr-dependencies.yaml:15","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/check-pr-title.yaml:19","Warn: no topLevel permission defined: .github/workflows/check-pr-dependencies.yaml:1","Info: found token with 'none' permissions: .github/workflows/check-pr-title.yaml:1","Warn: no topLevel permission defined: .github/workflows/lint.yaml:1","Info: found token with 'none' permissions: .github/workflows/quantitative.yaml:1","Warn: no topLevel permission defined: .github/workflows/stale.yml:1","Warn: no topLevel permission defined: .github/workflows/test.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-pr-dependencies.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/coreruleset/check-pr-dependencies.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/quantitative.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/coreruleset/quantitative.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/quantitative.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/coreruleset/quantitative.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/quantitative.yaml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/coreruleset/coreruleset/quantitative.yaml/main?enable=pin","Warn: pipCommand not pinned by hash: .github/workflows/lint.yaml:47","Warn: pipCommand not pinned by hash: .github/workflows/lint.yaml:48","Warn: pipCommand not pinned by hash: .github/workflows/lint.yaml:63","Warn: pipCommand not pinned by hash: .github/workflows/lint.yaml:64","Warn: pipCommand not pinned by hash: .github/workflows/lint.yaml:123","Warn: pipCommand not pinned by hash: .github/workflows/lint.yaml:124","Info:   7 out of   9 GitHub-owned GitHubAction dependencies pinned","Info:   2 out of   4 third-party GitHubAction dependencies pinned","Info:   0 out of   6 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: Passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Signed-Releases","score":8,"reason":"5 out of the last 5 releases have a total of 5 signed artifacts.","details":["Info: signed release artifact: coreruleset-4.17.1-minimal.tar.gz.asc: https://github.com/coreruleset/coreruleset/releases/tag/v4.17.1","Info: signed release artifact: coreruleset-4.17.0-minimal.tar.gz.asc: https://github.com/coreruleset/coreruleset/releases/tag/v4.17.0","Info: signed release artifact: coreruleset-4.16.0-minimal.tar.gz.asc: https://github.com/coreruleset/coreruleset/releases/tag/v4.16.0","Info: signed release artifact: coreruleset-4.15.0-minimal.tar.gz.asc: https://github.com/coreruleset/coreruleset/releases/tag/v4.15.0","Info: signed release artifact: coreruleset-4.14.0-minimal.tar.gz.asc: https://github.com/coreruleset/coreruleset/releases/tag/v4.14.0","Warn: release artifact v4.17.1 does not have provenance: https://api.github.com/repos/coreruleset/coreruleset/releases/237644940","Warn: release artifact v4.17.0 does not have provenance: https://api.github.com/repos/coreruleset/coreruleset/releases/236676383","Warn: release artifact v4.16.0 does not have provenance: https://api.github.com/repos/coreruleset/coreruleset/releases/228604992","Warn: release artifact v4.15.0 does not have provenance: https://api.github.com/repos/coreruleset/coreruleset/releases/222693421","Warn: release artifact v4.14.0 does not have provenance: https://api.github.com/repos/coreruleset/coreruleset/releases/215473288"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":1,"reason":"branch protection is not maximal on development and all release branches","details":["Warn: branch protection not enabled for branch 'v4.0/dev'","Warn: branch protection not enabled for branch 'v3.2/master'","Info: 'allow deletion' disabled on branch 'main'","Info: 'allow deletion' disabled on branch 'v3.3/master'","Info: 'force pushes' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'v3.3/master'","Info: 'branch protection settings apply to administrators' is required to merge on branch 'v3.3/master'","Info: 'stale review dismissal' is required to merge on branch 'v3.3/master'","Warn: required approving review count is 1 on branch 'main'","Warn: required approving review count is 1 on branch 'v3.3/master'","Warn: codeowners review is not required on branch 'main'","Warn: codeowners review is not required on branch 'v3.3/master'","Info: 'last push approval' is required to merge on branch 'v3.3/master'","Warn: 'up-to-date branches' is disabled on branch 'v3.3/master'","Warn: no status checks found to merge onto branch 'main'","Info: status check found to merge onto on branch 'v3.3/master'","Info: PRs are required in order to make changes on branch 'main'","Info: PRs are required in order to make changes on branch 'v3.3/master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T21:46:59.885Z","repository_id":37002000,"created_at":"2025-08-17T21:46:59.891Z","updated_at":"2025-08-17T21:46:59.891Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28423804,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T13:30:50.153Z","status":"ssl_error","status_checked_at":"2026-01-14T13:29:08.907Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crs","owasp","ruleset","security","waf"],"created_at":"2024-07-31T15:01:09.527Z","updated_at":"2026-01-14T14:36:12.857Z","avatar_url":"https://github.com/coreruleset.png","language":"Python","funding_links":["https://owasp.org/donate/?reponame=www-project-modsecurity-core-rule-set\u0026title=OWASP+CRS"],"categories":["Python","security","OWASP Tools","Security"],"sub_categories":["WAF and Rule Sets","WAF"],"readme":"[![OWASP Flagship](https://img.shields.io/badge/owasp-flagship%20project-38a047.svg)](https://owasp.org/projects/)\n[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1390/badge)](https://bestpractices.coreinfrastructure.org/projects/1390)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\n| Branch      | Status |\n|-------------|-------|\n| main        | ![GHA build main](https://github.com/coreruleset/coreruleset/actions/workflows/test.yml/badge.svg?branch=main) |\n| v3.3/master | ![GHA build v3.3/master](https://github.com/coreruleset/coreruleset/workflows/Regression%20Tests/badge.svg?branch=v3.3%2Fmaster) |\n\n\n# OWASP CRS\n\nThe OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.\n\n## CRS Resources, Related Projects and Tools\n\nPlease see the [OWASP CRS page](https://coreruleset.org/) to get introduced to CRS and view resources on installation, configuration, and working with CRS. There you can also find a [list of projects related to CRS](https://coreruleset.org/) and a [list of tools](https://coreruleset.org/docs/6-development/6-6-useful_tools/) for both developers and users.\n\n## Contributing to CRS\n\nWe strive to make the OWASP CRS accessible to a wide audience of beginner and experienced users. We are interested in hearing any bug reports, false-positive alert reports, evasions, usability issues, and suggestions for new detections.\n\n[Create an issue on GitHub](https://github.com/coreruleset/coreruleset/issues) to report a false positive or false negative (evasion). Please include your installed version and the relevant portions of your audit log. We will try and address your issue and potentially ask for additional information to reproduce your problem. Please also note that stale issues will be flagged and closed after 120 days. You can search for stale issues with the following [search query](https://github.com/coreruleset/coreruleset/issues?q=label%3A%22Stale+issue%22).\n\n[Sign up for our Google Group](https://groups.google.com/a/owasp.org/g/modsecurity-core-rule-set-project) to ask general usage questions and participate in discussions on the CRS. Also [here](https://lists.owasp.org/pipermail/owasp-modsecurity-core-rule-set/index) you can find the archives for the previous mailing list.\n\n[Join the #coreruleset channel on OWASP Slack](https://owasp.slack.com/) to chat about the CRS. ([Click here](https://owasp.org/slack/invite) to get an invitation if you are not yet registered on the OWASP slack. It's open to non-members too.)\n\nRead also our documentation on [how to contribute](./CONTRIBUTING.md).\n\n## License\n\nCopyright (c) 2006-2020 Trustwave and contributors. All rights reserved.\u003cbr\u003e\nCopyright (c) 2021-2025 CRS project. All rights reserved.\n\nThe OWASP CRS is distributed under Apache Software License (ASL) version 2. Please see the enclosed LICENSE file for full details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoreruleset%2Fcoreruleset","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoreruleset%2Fcoreruleset","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoreruleset%2Fcoreruleset/lists"}