{"id":15036930,"url":"https://github.com/kubearmor/kubearmor","last_synced_at":"2026-10-19T08:00:48.982Z","repository":{"id":36973547,"uuid":"316098156","full_name":"kubearmor/KubeArmor","owner":"kubearmor","description":"Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).","archived":false,"fork":false,"pushed_at":"2026-10-13T08:26:02.000Z","size":83208,"stargazers_count":2624,"open_issues_count":411,"forks_count":533,"subscribers_count":17,"default_branch":"main","last_synced_at":"2026-10-13T08:37:13.117Z","etag":null,"topics":["bpf","containers","ebpf","hacktoberfest","kernel","kubernetes","lsm","policy","sandbox","security","system","tool"],"latest_commit_sha":null,"homepage":"https://kubearmor.io/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kubearmor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","accessibility":null,"support":null,"governance":"GOVERNANCE.md","roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":"MAINTAINERS.md","copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2020-11-26T01:59:16.000Z","updated_at":"2026-10-13T06:12:32.000Z","dependencies_parsed_at":"2026-10-13T08:23:48.366Z","dependency_job_id":null,"html_url":"https://github.com/kubearmor/KubeArmor","commit_stats":{"total_commits":2236,"total_committers":112,"mean_commits":"19.964285714285715","dds":0.5782647584973166,"last_synced_commit":"3481433fae33f813535363766dcd913c6a0014b5"},"previous_names":["accuknox/kubearmor"],"tags_count":96,"template":false,"template_full_name":null,"purl":"pkg:github/kubearmor/KubeArmor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2FKubeArmor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2FKubeArmor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2FKubeArmor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2FKubeArmor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kubearmor","download_url":"https://codeload.github.com/kubearmor/KubeArmor/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kubearmor%2FKubeArmor/sbom","scorecard":{"id":388572,"data":{"date":"2025-08-18T16:19:29Z","repo":{"name":"github.com/kubearmor/KubeArmor","commit":"2d237f6df8b6f4ac1e9370825df42102a8605120"},"scorecard":{"version":"v4.13.1","commit":"49c0eed3a423f00c872b5c3c9f1bbca9e8aae799"},"score":7.7,"checks":[{"name":"Binary-Artifacts","score":0,"reason":"binaries present in source code","details":["Warn: binary detected: KubeArmor/enforcer/bpflsm/enforcer_bpfeb.o:1","Warn: binary detected: KubeArmor/enforcer/bpflsm/enforcer_bpfel.o:1","Warn: binary detected: KubeArmor/enforcer/bpflsm/enforcer_path_bpfeb.o:1","Warn: binary detected: KubeArmor/enforcer/bpflsm/enforcer_path_bpfel.o:1","Warn: binary detected: KubeArmor/presets/anonmapexec/anonmapexec_bpfeb.o:1","Warn: binary detected: KubeArmor/presets/anonmapexec/anonmapexec_bpfel.o:1","Warn: binary detected: KubeArmor/presets/exec/exec_bpfeb.o:1","Warn: binary detected: KubeArmor/presets/exec/exec_bpfel.o:1","Warn: binary detected: KubeArmor/presets/filelessexec/filelessexec_bpfeb.o:1","Warn: binary detected: KubeArmor/presets/filelessexec/filelessexec_bpfel.o:1","Warn: binary detected: KubeArmor/presets/protectenv/protectenv_bpfeb.o:1","Warn: binary detected: KubeArmor/presets/protectenv/protectenv_bpfel.o:1","Warn: binary detected: KubeArmor/presets/protectproc/protectproc_bpfeb.o:1","Warn: binary detected: KubeArmor/presets/protectproc/protectproc_bpfel.o:1","Warn: binary detected: KubeArmor/utils/bpflsmprobe/probe_bpfeb.o:1","Warn: binary detected: KubeArmor/utils/bpflsmprobe/probe_bpfel.o:1","Warn: binary detected: examples/vagrant-selinux/selinux-test/bash:1","Warn: binary detected: examples/vagrant-selinux/selinux-test/read:1","Warn: binary detected: examples/vagrant-selinux/selinux-test/readwrite:1","Warn: binary detected: examples/vagrant-selinux/selinux-test/write:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":10,"reason":"branch protection is fully enabled on development and all release branches","details":["Info: 'force pushes' disabled on branch 'main'","Info: 'allow deletion' disabled on branch 'main'","Info: status checks require up-to-date branches for 'main'","Info: status check found to merge onto on branch 'main'","Info: number of required reviewers is 2 on branch 'main'","Info: stale review dismissal enabled on branch 'main'","Info: settings apply to administrators on branch 'main'","Info: codeowner review is required on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":10,"reason":"10 out of 10 merged PRs checked by a CI test -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":5,"reason":"badge detected: passing","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#code-review"}},{"name":"Contributors","score":10,"reason":"30 different organizations found -- score normalized to 10","details":["Info: contributors work for 5GSEC,JIITODC,LambdaTest,NixOS,PixysOS-Devices,SeleniumHQ,VocabCLI,accuknox,aws,boanlab,cclab-inu,cern,dankook university,e6data,ibm,incheon national university,kloudone,kubearmor,lambdatest,layer5io,meshery,nirmata,oai,odigos-io,open-horizon,osPrims,osdc,publiclab,runfinch,wolfi-dev"],"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: tool 'RenovateBot' is used: renovate.json:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: OSSFuzz integration found","Info: GoBuiltInFuzzer integration found: KubeArmor/core/containerPolicy_fuzz_test.go:13","Info: GoBuiltInFuzzer integration found: KubeArmor/core/hostPolicy_fuzz_test.go:12"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: License file found in expected location: LICENSE:1","Info: FSF or OSI recognized license: LICENSE:1"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#license"}},{"name":"Maintained","score":10,"reason":"30 commit(s) out of 30 and 10 issue activity out of 30 found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#maintained"}},{"name":"Packaging","score":10,"reason":"publishing workflow detected","details":["Info: GitHub/GitLab publishing workflow used in run https://api.github.com/repos/kubearmor/KubeArmor/actions/runs/17044343771: .github/workflows/ci-latest-release.yml:233"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:199: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:206: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:245: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:255: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:259: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:269: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:272: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:277: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:283: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:295: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:324: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:121: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:124: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-latest-release.yml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-latest-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:124: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:125: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:180: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:181: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:212: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-marketplace-release.yml:231: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-marketplace-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-merge-coverage.yaml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-merge-coverage.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-merge-coverage.yaml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-merge-coverage.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-merge-coverage.yaml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-merge-coverage.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-merge-coverage.yaml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-merge-coverage.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-multiubuntu-push.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-multiubuntu-push.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-multiubuntu-push.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-multiubuntu-push.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-multiubuntu-push.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-multiubuntu-push.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-multiubuntu-push.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-multiubuntu-push.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-multiubuntu-push.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-multiubuntu-push.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-network-tests.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-network-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-network-tests.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-network-tests.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-network-tests.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-network-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-network-tests.yml:173: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-network-tests.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-network-tests.yml:189: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-network-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-operator-release.yaml:127: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-operator-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-stable-release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-stable-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-stable-release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-stable-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-stable-release.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-stable-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-stable-release.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-stable-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-systemd-release.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-systemd-release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-controllers.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-controllers.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-controllers.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-controllers.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-controllers.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-controllers.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-controllers.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-controllers.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ginkgo.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ginkgo.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ginkgo.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ginkgo.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-ginkgo.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ginkgo.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ginkgo.yml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ginkgo.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ginkgo.yml:263: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ginkgo.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-go.yml:108: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-helm-charts.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-helm-charts.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-helm-charts.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-helm-charts.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-helm-charts.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-helm-charts.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-operator.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-operator.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-operator.yaml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-operator.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-systemd.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-systemd.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-systemd.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-systemd.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-systemd.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-systemd.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ubi-image.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ubi-image.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ubi-image.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ubi-image.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-ubi-image.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ubi-image.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-test-ubi-image.yml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ubi-image.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-test-ubi-image.yml:165: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-test-ubi-image.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:121: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:134: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-trivy-scan.yaml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-trivy-scan.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scorecard.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/scorecard.yml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:6","Warn: containerImage not pinned by hash: Dockerfile:42","Warn: containerImage not pinned by hash: Dockerfile:48","Warn: containerImage not pinned by hash: Dockerfile:61","Warn: containerImage not pinned by hash: Dockerfile:78","Warn: containerImage not pinned by hash: Dockerfile:115","Warn: containerImage not pinned by hash: Dockerfile.init:5","Warn: containerImage not pinned by hash: examples/multiubuntu/build/Dockerfile:4","Warn: containerImage not pinned by hash: examples/multiubuntu/build/Dockerfile:13: pin your Docker image by updating ubuntu:18.04 to ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98","Warn: containerImage not pinned by hash: pkg/KubeArmorController/Dockerfile:5","Warn: containerImage not pinned by hash: pkg/KubeArmorController/Dockerfile:27","Warn: containerImage not pinned by hash: pkg/KubeArmorOperator/Dockerfile:4","Warn: containerImage not pinned by hash: pkg/KubeArmorOperator/Dockerfile:46","Warn: containerImage not pinned by hash: pkg/KubeArmorOperator/Dockerfile:73","Warn: goCommand not pinned by hash: Dockerfile:17","Warn: goCommand not pinned by hash: Dockerfile:18","Warn: pipCommand not pinned by hash: examples/multiubuntu/build/Dockerfile:25","Warn: downloadThenRun not pinned by hash: .github/workflows/install-llvm.sh:11","Warn: downloadThenRun not pinned by hash: .github/workflows/install-llvm.sh:17","Warn: downloadThenRun not pinned by hash: .github/workflows/install-llvm.sh:23","Warn: downloadThenRun not pinned by hash: contribution/Killercoda-Kubearmor/k3s_installation_killercoda.sh:20","Warn: downloadThenRun not pinned by hash: contribution/Killercoda-Kubearmor/k3s_installation_killercoda.sh:23","Warn: downloadThenRun not pinned by hash: contribution/Killercoda-Kubearmor/k3s_installation_killercoda.sh:27","Warn: downloadThenRun not pinned by hash: contribution/Killercoda-Kubearmor/k3s_installation_killercoda.sh:30","Warn: downloadThenRun not pinned by hash: contribution/k3s/install_k3s.sh:20","Warn: downloadThenRun not pinned by hash: contribution/k3s/install_k3s.sh:23","Warn: downloadThenRun not pinned by hash: contribution/k3s/install_k3s.sh:27","Warn: downloadThenRun not pinned by hash: contribution/k3s/install_k3s.sh:30","Warn: goCommand not pinned by hash: contribution/license/add-license-header.sh:6","Warn: downloadThenRun not pinned by hash: contribution/self-managed-k8s-selinux/setup.sh:91","Warn: downloadThenRun not pinned by hash: contribution/self-managed-k8s/setup.sh:28","Warn: downloadThenRun not pinned by hash: contribution/self-managed-k8s/setup.sh:34","Warn: downloadThenRun not pinned by hash: contribution/self-managed-k8s/setup.sh:40","Warn: goCommand not pinned by hash: contribution/self-managed-k8s/setup.sh:94","Warn: goCommand not pinned by hash: contribution/self-managed-k8s/setup.sh:95","Warn: downloadThenRun not pinned by hash: contribution/self-managed-k8s/setup.sh:112","Warn: downloadThenRun not pinned by hash: contribution/vagrant/setup.sh:42","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:136","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:142","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:143","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:144","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:184","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:221","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:222","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:223","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:229","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:230","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:231","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:255","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-latest-release.yml:321","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:82","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:88","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:89","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:90","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:91","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:92","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:108","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:114","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:115","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:116","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:117","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-marketplace-release.yml:118","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-network-tests.yml:168","Warn: goCommand not pinned by hash: .github/workflows/ci-network-tests.yml:183","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:121","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:124","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:125","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:145","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:146","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:152","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-operator-release.yaml:153","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:29","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:39","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:40","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:41","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:42","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:43","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-stable-release.yml:44","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-systemd-release.yml:76","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-test-controllers.yml:112","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-test-ginkgo.yml:236","Warn: goCommand not pinned by hash: .github/workflows/ci-test-systemd.yml:49","Warn: goCommand not pinned by hash: .github/workflows/ci-test-systemd.yml:50","Warn: downloadThenRun not pinned by hash: .github/workflows/ci-test-ubi-image.yml:144","Warn: goCommand not pinned by hash: .github/workflows/ci-test-ubi-image.yml:159","Info:   2 out of  68 GitHub-owned GitHubAction dependencies pinned","Info:   2 out of  58 third-party GitHubAction dependencies pinned","Info:   0 out of  14 containerImage dependencies pinned","Info:   7 out of  16 goCommand dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned","Info:   0 out of  61 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: all commits (30) are checked with a SAST tool","Info: SAST tool detected: CodeQL"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#sast"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":8,"reason":"5 out of 5 artifacts are signed or have provenance","details":["Warn: release artifact v1.6.1 does not have provenance: https://api.github.com/repos/kubearmor/KubeArmor/releases/236815756","Info: signed release artifact: kubearmor_1.6.1_amd64_checksums.txt.sig: https://api.github.com/repos/kubearmor/KubeArmor/releases/assets/278385869","Warn: release artifact v1.6.0 does not have provenance: https://api.github.com/repos/kubearmor/KubeArmor/releases/235642045","Info: signed release artifact: kubearmor_1.6.0_checksums.txt.sig: https://api.github.com/repos/kubearmor/KubeArmor/releases/assets/277132873","Warn: release artifact v1.5.6 does not have provenance: https://api.github.com/repos/kubearmor/KubeArmor/releases/216745851","Info: signed release artifact: kubearmor_1.5.6_checksums.txt.sig: https://api.github.com/repos/kubearmor/KubeArmor/releases/assets/252305653","Warn: release artifact v1.5.5 does not have provenance: https://api.github.com/repos/kubearmor/KubeArmor/releases/215651694","Info: signed release artifact: kubearmor_1.5.5_checksums.txt.sig: https://api.github.com/repos/kubearmor/KubeArmor/releases/assets/250640881","Warn: release artifact v1.5.4 does not have provenance: https://api.github.com/repos/kubearmor/KubeArmor/releases/206446134","Info: signed release artifact: kubearmor_1.5.4_checksums.txt.sig: https://api.github.com/repos/kubearmor/KubeArmor/releases/assets/238439352"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: topLevel permissions set to 'read-all': .github/workflows/ci-latest-release.yml:26","Info: topLevel permissions set to 'read-all': .github/workflows/ci-marketplace-release.yml:11","Warn: no topLevel permission defined: .github/workflows/ci-merge-coverage.yaml:1: Visit https://app.stepsecurity.io/secureworkflow/kubearmor/KubeArmor/ci-merge-coverage.yaml/main?enable=permissions\nTick the 'Restrict permissions for GITHUB_TOKEN'\nUntick other options\nNOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)","Info: topLevel permissions set to 'read-all': .github/workflows/ci-multiubuntu-push.yml:8","Info: topLevel permissions set to 'read-all': .github/workflows/ci-network-tests.yml:26","Info: topLevel permissions set to 'read-all': .github/workflows/ci-operator-release.yaml:24","Info: topLevel permissions set to 'read-all': .github/workflows/ci-stable-release.yml:10","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/ci-stable-release.yml:61: Verify which permissions are needed and consider whether you can reduce them. (High effort)","Info: topLevel permissions set to 'read-all': .github/workflows/ci-systemd-release.yml:15","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-controllers.yml:12","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-ginkgo.yml:26","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-go.yml:22","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-helm-charts.yml:16","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-operator.yaml:21","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-systemd.yml:20","Info: topLevel permissions set to 'read-all': .github/workflows/ci-test-ubi-image.yml:25","Info: topLevel permissions set to 'read-all': .github/workflows/ci-trivy-scan.yaml:19","Info: topLevel permissions set to 'read-all': .github/workflows/codeql.yml:23","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":8,"reason":"2 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-x4rx-4gw3-53p4 / GO-2025-3830","Warn: Project is vulnerable to: GHSA-fv92-fjc5-jj9h / GO-2025-3787"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/49c0eed3a423f00c872b5c3c9f1bbca9e8aae799/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-18T17:15:39.310Z","repository_id":36973547,"created_at":"2025-08-18T17:15:39.310Z","updated_at":"2025-08-18T17:15:39.310Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38351721,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-19T02:00:06.414Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bpf","containers","ebpf","hacktoberfest","kernel","kubernetes","lsm","policy","sandbox","security","system","tool"],"created_at":"2024-09-24T20:32:47.971Z","updated_at":"2026-10-19T08:00:48.975Z","avatar_url":"https://github.com/kubearmor.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"![](.gitbook/assets/logo.png)\n\n[![Build Status](https://github.com/kubearmor/KubeArmor/actions/workflows/ci-test-suite.yml/badge.svg)](https://github.com/kubearmor/KubeArmor/actions/workflows/ci-test-suite.yml/)\n[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/5401/badge)](https://bestpractices.coreinfrastructure.org/projects/5401)\n[![CLOMonitor](https://img.shields.io/endpoint?url=https://clomonitor.io/api/projects/cncf/kubearmor/badge)](https://clomonitor.io/projects/cncf/kubearmor)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/kubearmor/kubearmor/badge)](https://securityscorecards.dev/viewer/?uri=github.com/kubearmor/KubeArmor)\n[![SLSA Level 3](https://slsa.dev/images/gh-badge-level3.svg)](https://github.com/kubearmor/KubeArmor/actions/workflows/slsa-verify.yml)\n[![codecov](https://codecov.io/gh/kubearmor/KubeArmor/branch/main/graph/badge.svg)](https://codecov.io/gh/kubearmor/KubeArmor)\n[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fkubearmor%2FKubeArmor.svg?type=shield\u0026issueType=license)](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubearmor%2FKubeArmor?ref=badge_shield)\n[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fkubearmor%2FKubeArmor.svg?type=shield\u0026issueType=security)](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubearmor%2FKubeArmor?ref=badge_shield)\n[![Slack](https://img.shields.io/badge/Join%20Our%20Community-Slack-blue)](https://cloud-native.slack.com/archives/C02R319HVL3)\n[![Discussions](https://img.shields.io/badge/Got%20Questions%3F-Chat-Violet)](https://github.com/kubearmor/KubeArmor/discussions)\n[![Docker Downloads](https://img.shields.io/docker/pulls/kubearmor/kubearmor)](https://hub.docker.com/r/kubearmor/kubearmor)\n[![ArtifactHub](https://img.shields.io/badge/ArtifactHub-KubeArmor-blue?logo=artifacthub\u0026labelColor=grey\u0026color=green)](https://artifacthub.io/packages/search?kind=19)\n\nKubeArmor is a cloud-native runtime security enforcement system that restricts the behavior \\(such as process execution, file access, and networking operations\\) of pods, containers, and nodes (VMs) at the system level.\n\nKubeArmor leverages [Linux security modules \\(LSMs\\)](https://en.wikipedia.org/wiki/Linux_Security_Modules) such as [AppArmor](https://en.wikipedia.org/wiki/AppArmor), [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux), or [BPF-LSM](https://docs.kernel.org/bpf/prog_lsm.html) to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.\n\n|  |   |\n|:---|:---|\n| :muscle: **[Harden Infrastructure](getting-started/hardening_guide.md)** \u003chr\u003e:chains: Protect critical paths such as cert bundles \u003cbr\u003e:clipboard: MITRE, STIGs, CIS based rules \u003cbr\u003e:left_luggage: Restrict access to raw DB table | :ring: **[Least Permissive Access](getting-started/least_permissive_access.md)** \u003chr\u003e:traffic_light: Process Whitelisting \u003cbr\u003e:traffic_light: Network Whitelisting \u003cbr\u003e:control_knobs: Control access to sensitive assets |\n| :telescope: **[Application Behavior](getting-started/workload_visibility.md)** \u003chr\u003e:dna: Process execs, File System accesses \u003cbr\u003e:compass: Service binds, Ingress, Egress connections \u003cbr\u003e:microscope: Sensitive system call profiling | :snowflake: **[Deployment Models](getting-started/deployment_models.md)** \u003chr\u003e:wheel_of_dharma: Kubernetes Deployment\u003cbr\u003e:whale2: Containerized Deployment\u003cbr\u003e:computer: VM/Bare-Metal Deployment |\n\n## Architecture Overview\n\n![KubeArmor High Level Design](.gitbook/assets/kubearmor_overview.png)\n\n## Documentation :notebook:\n\n* :point_right: [Getting Started](getting-started/deployment_guide.md)\n* :dart: [Use Cases](getting-started/use-cases/hardening.md)\n* :heavy_check_mark: [KubeArmor Support Matrix](getting-started/support_matrix.md)\n* :chess_pawn: [How is KubeArmor different?](getting-started/differentiation.md)\n* :scroll: Security Policy for Pods/Containers [[Spec](getting-started/security_policy_specification.md)] [[Examples](getting-started/security_policy_examples.md)]\n* :scroll: Cluster level security Policy for Pods/Containers [[Spec](getting-started/cluster_security_policy_specification.md)] [[Examples](getting-started/cluster_security_policy_examples.md)]\n* :scroll: Security Policy for Hosts/Nodes [[Spec](getting-started/host_security_policy_specification.md)] [[Examples](getting-started/host_security_policy_examples.md)]\n* :scroll: Network Security Policy for Hosts/Nodes [[Spec](getting-started/network_security_policy_specification.md)] [[Examples](getting-started/network_security_policy_examples.md)]\u003cbr\u003e\n... [detailed documentation](https://docs.kubearmor.io/kubearmor/)\n\n### Contributors :busts_in_silhouette:\n\n* :blue_book: [Contribution Guide](contribution/contribution_guide.md)\n* :technologist: [Development Guide](contribution/development_guide.md), [Testing Guide](contribution/testing_guide.md)\n* :raised_hand: [Join KubeArmor Slack](https://cloud-native.slack.com/archives/C02R319HVL3) (If you need an invitation to join CNCF slack, sign up using [inviter.co/cncf](https://inviter.co/cncf))\n* :question: [FAQs](getting-started/FAQ.md)\n\n### Biweekly Meeting\n\n- :speaking_head: [Zoom Link](http://zoom.kubearmor.io)\n- :page_facing_up: Minutes: [Document](https://docs.google.com/document/d/1IqIIG9Vz-PYpbUwrH0u99KYEM1mtnYe6BHrson4NqEs/edit)\n- :calendar: Calendar invite: [Google Calendar](http://www.google.com/calendar/event?action=TEMPLATE\u0026dates=20220210T150000Z%2F20220210T153000Z\u0026text=KubeArmor%20Community%20Call\u0026location=\u0026details=%3Ca%20href%3D%22https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1IqIIG9Vz-PYpbUwrH0u99KYEM1mtnYe6BHrson4NqEs%2Fedit%22%3EMinutes%20of%20Meeting%3C%2Fa%3E%0A%0A%3Ca%20href%3D%22%20http%3A%2F%2Fzoom.kubearmor.io%22%3EZoom%20Link%3C%2Fa%3E\u0026recur=RRULE:FREQ=WEEKLY;INTERVAL=2;BYDAY=TH\u0026ctz=Asia/Calcutta), [ICS file](getting-started/resources/KubeArmorMeetup.ics)\n\n### Community \u0026 Governance\n\nKubeArmor is a community-governed project. The following documents describe how the project is run:\n\n- :scroll: [Governance](./GOVERNANCE.md) — roles, decision-making, vendor neutrality, sub-teams, voting.\n- :busts_in_silhouette: [Maintainers](./MAINTAINERS.md) — current Maintainers, Reviewers, and Emeritus Maintainers, with affiliations.\n- :handshake: [Code of Conduct](./CODE_OF_CONDUCT.md) — we follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).\n- :package: [Release Process](./RELEASES.md) — cadence, release candidates, release manager, support window.\n- :lock: [Security Policy](./SECURITY.md) — how to report a vulnerability.\n\n## Notice/Credits :handshake:\n\n- KubeArmor uses [Tracee](https://github.com/aquasecurity/tracee/)'s system call utility functions.\n\n## CNCF\n\nKubeArmor is [Sandbox Project](https://www.cncf.io/projects/kubearmor/) of the Cloud Native Computing Foundation.\n![CNCF SandBox Project](.gitbook/assets/cncf-sandbox.png)\n\n## ROADMAP\n\nKubeArmor roadmap is tracked via [KubeArmor Projects](https://github.com/orgs/kubearmor/projects?query=is%3Aopen)\n\n## Related Repositories\n\nKubeArmor is more than a single repository. The following repositories under the [`kubearmor`](https://github.com/kubearmor) GitHub organization are part of the wider project. Each is governed under [GOVERNANCE.md](./GOVERNANCE.md) — see the *Subprojects* section there for how core and community subprojects are classified.\n\n\u003e **Note:** This list covers actively maintained repositories. For the complete (including archived) list, see the [organization page](https://github.com/orgs/kubearmor/repositories).\n\n### Core\n\n| Repository | What it is |\n|---|---|\n| [KubeArmor](https://github.com/kubearmor/KubeArmor) | The main runtime security enforcement daemon. This repository. |\n| [kubearmor-client](https://github.com/kubearmor/kubearmor-client) | `karmor`, the official command-line tool for installing, configuring, and observing KubeArmor. |\n| [charts](https://github.com/kubearmor/charts) | Official Helm charts for KubeArmor and the KubeArmor Operator. |\n| [policy-templates](https://github.com/kubearmor/policy-templates) | Community-curated library of System and Network policy templates for KubeArmor (and Cilium). |\n| [kubearmor.io](https://github.com/kubearmor/kubearmor.io) | Source for the [kubearmor.io](https://kubearmor.io) website. |\n| [.project](https://github.com/kubearmor/.project) | Project metadata for CNCF `.project` automation (CLOMonitor, landscape, etc.). |\n\n### Integrations and adapters\n\n| Repository | What it is |\n|---|---|\n| [otel-adapter](https://github.com/kubearmor/otel-adapter) | OpenTelemetry receiver for KubeArmor events and alerts. |\n| [kubearmor-prometheus-exporter](https://github.com/kubearmor/kubearmor-prometheus-exporter) | Prometheus exporter for KubeArmor metrics. |\n| [kubearmor-relay-server](https://github.com/kubearmor/kubearmor-relay-server) | Relay/log streaming server that aggregates events from KubeArmor agents. |\n| [kubearmor-kafka-client](https://github.com/kubearmor/kubearmor-kafka-client) | Kafka client for streaming KubeArmor logs to a Kafka cluster. |\n| [kubearmor-log-client](https://github.com/kubearmor/kubearmor-log-client) | Standalone log client (stdout or file) for consuming KubeArmor logs. |\n| [grafana-datasource](https://github.com/kubearmor/grafana-datasource) | Grafana data source backend for visualising KubeArmor data. |\n| [kubearmor-dashboards](https://github.com/kubearmor/kubearmor-dashboards) | ELK-stack dashboards for KubeArmor logs and alerts. |\n| [kubearmor-action](https://github.com/kubearmor/kubearmor-action) | GitHub Action that runs KubeArmor against a workload for CI security checks. |\n| [rancherui](https://github.com/kubearmor/rancherui) | Rancher Manager UI extension for managing KubeArmor through Rancher. |\n| [sidekick](https://github.com/kubearmor/sidekick) | Glue to connect KubeArmor events into downstream ecosystems. |\n\n### Deployment and packaging\n\n| Repository | What it is |\n|---|---|\n| [custom-packages](https://github.com/kubearmor/custom-packages) | Custom `.deb` / `.rpm` packaging definitions. |\n| [packer-plugin-kubearmor](https://github.com/kubearmor/packer-plugin-kubearmor) | HashiCorp Packer plugin for baking KubeArmor into images. |\n\n### Specialised projects\n\n| Repository | What it is |\n|---|---|\n| [k8tls](https://github.com/kubearmor/k8tls) | (Pronounced *cattles*) — assesses server port security by detecting TLS and certificate configuration. |\n| [modelarmor](https://github.com/kubearmor/modelarmor) | ML model security, including pickle-injection PoC and adversarial-attack demos. |\n| [kvm-service](https://github.com/kubearmor/kvm-service) | Service for orchestrating KubeArmor policies to VMs and bare-metal hosts via either a Kubernetes or non-Kubernetes control plane. |\n| [libbpf](https://github.com/kubearmor/libbpf) | Go eBPF helper library based on the upstream libbpf API. |\n| [kbc](https://github.com/kubearmor/kbc) | KubeArmor Benchmark Calculator. |\n\n\u003c!--\nTODO: Confirm classification of each repository as **core subproject** (governed by this repo's GOVERNANCE.md, CODEOWNERS subset of Maintainers) versus **community subproject** (own MAINTAINERS file, autonomous on technical decisions but bound by CoC and vendor-neutrality clauses). This is CNCF DD blocker F.\n\nAlso, the following repositories have not been pushed to in over 12 months and may be candidates for archiving — confirm with Maintainers before next release:\n  artefacts, certified-operators, marketplace-kubernetes, minikube, kubearmor.github.io, openhorizon-demo (already archived), test-enterprise-gha, runtime-security-best-practices, log4j-CVE-2021-44228, kastore, koach, KubeArmor-demo (last push 2023), tag-security, kubearmor-relay-server-KA (looks duplicated).\n--\u003e\n\nThis list is generated iteratively — open a pull request to add a new repository or correct a description.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubearmor%2Fkubearmor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkubearmor%2Fkubearmor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkubearmor%2Fkubearmor/lists"}