{"id":13394162,"url":"https://github.com/medusajs/medusa","last_synced_at":"2026-10-18T21:20:28.570Z","repository":{"id":36950958,"uuid":"234739976","full_name":"medusajs/medusa","owner":"medusajs","description":"The world's most flexible commerce platform for agents and developers","archived":false,"fork":false,"pushed_at":"2026-10-15T13:28:07.000Z","size":903472,"stargazers_count":36761,"open_issues_count":240,"forks_count":5416,"subscribers_count":206,"default_branch":"develop","last_synced_at":"2026-10-15T17:07:56.786Z","etag":null,"topics":["ai-coding","ai-tools","commerce","e-commerce","ecommerce","framework","javascript","medusa","nodejs","react","typescript"],"latest_commit_sha":null,"homepage":"https://medusajs.com","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/medusajs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":["medusajs"]}},"created_at":"2020-01-18T13:39:04.000Z","updated_at":"2026-10-15T16:57:47.000Z","dependencies_parsed_at":"2026-10-08T10:27:43.238Z","dependency_job_id":null,"html_url":"https://github.com/medusajs/medusa","commit_stats":{"total_commits":6961,"total_committers":298,"mean_commits":"23.359060402684563","dds":0.7781927883924724,"last_synced_commit":"f7aaf2c8bb243c8478a943285628ba8eb331feb6"},"previous_names":[],"tags_count":14641,"template":false,"template_full_name":null,"purl":"pkg:github/medusajs/medusa","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/medusajs%2Fmedusa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/medusajs%2Fmedusa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/medusajs%2Fmedusa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/medusajs%2Fmedusa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/medusajs","download_url":"https://codeload.github.com/medusajs/medusa/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/medusajs%2Fmedusa/sbom","scorecard":{"id":634536,"data":{"date":"2025-08-11","repo":{"name":"github.com/medusajs/medusa","commit":"0128ed314cf4bb5d296ad9fde4b9c2ed85ce9ae3"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.2,"checks":[{"name":"Code-Review","score":7,"reason":"Found 18/25 approved changesets -- score normalized to 7","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/action.yml:1","Warn: no topLevel permission defined: .github/workflows/admin-i18n-validation.yml:1","Warn: no topLevel permission defined: .github/workflows/create-linear-issue-on-discussion.yml:1","Warn: no topLevel permission defined: .github/workflows/create-linear-issue-on-pr.yml:1","Warn: no topLevel permission defined: .github/workflows/docs-freshness-check.yml:1","Warn: no topLevel permission defined: .github/workflows/docs-test.yml:1","Warn: no topLevel permission defined: .github/workflows/docs-update-version.yml:1","Warn: no topLevel permission defined: .github/workflows/generate-public-references.yml:1","Warn: no topLevel permission defined: .github/workflows/oas-test.yml:1","Warn: no topLevel permission defined: .github/workflows/release-notifications.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1","Warn: no topLevel permission defined: .github/workflows/snapshot-this.yml:1","Warn: no topLevel permission defined: .github/workflows/stale-bot.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/team-labeler.yml:6","Warn: no topLevel permission defined: .github/workflows/test-cli-with-database.yml:1","Warn: no topLevel permission defined: .github/workflows/trigger-release.yml:1","Warn: no topLevel permission defined: .github/workflows/trigger-staging-deployment.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 29 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/action.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/action.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/action.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/action.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/action.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/action.yml:172: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/action.yml:230: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/action.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/admin-i18n-validation.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/admin-i18n-validation.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/admin-i18n-validation.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/admin-i18n-validation.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/create-linear-issue-on-discussion.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/create-linear-issue-on-discussion.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/create-linear-issue-on-pr.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/create-linear-issue-on-pr.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-freshness-check.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-freshness-check.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-freshness-check.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-freshness-check.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-freshness-check.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-freshness-check.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:96: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:152: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:226: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:231: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:267: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:284: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:289: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:325: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:399: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:404: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:169: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:174: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:209: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:342: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:347: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:382: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-test.yml:421: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-test.yml:426: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-update-version.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-update-version.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-update-version.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-update-version.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-update-version.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-update-version.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-update-version.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/docs-update-version.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:133: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:178: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:197: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:202: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:207: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:237: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:252: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:257: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:262: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/generate-public-references.yml:304: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/generate-public-references.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/oas-test.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/oas-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/oas-test.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/oas-test.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/oas-test.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/oas-test.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-notifications.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release-notifications.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-notifications.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release-notifications.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-notifications.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release-notifications.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-notifications.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release-notifications.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-notifications.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release-notifications.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/release.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/snapshot-this.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/snapshot-this.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/snapshot-this.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/snapshot-this.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/snapshot-this.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/snapshot-this.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/snapshot-this.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/snapshot-this.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale-bot.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/stale-bot.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/team-labeler.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/team-labeler.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/team-labeler.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/team-labeler.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-cli-with-database.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/test-cli-with-database.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-cli-with-database.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/test-cli-with-database.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trigger-release.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/trigger-release.yml/develop?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/trigger-release.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/trigger-release.yml/develop?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/trigger-release.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/medusajs/medusa/trigger-release.yml/develop?enable=pin","Warn: downloadThenRun not pinned by hash: integration-tests/scripts/cli/get-products.sh:5","Warn: npmCommand not pinned by hash: .github/workflows/test-cli-with-database.yml:58","Info:   0 out of  46 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  36 third-party GitHubAction dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned","Info:   0 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":0,"reason":"73 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8","Warn: Project is vulnerable to: GHSA-xffm-g5w8-qvg7","Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q","Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38","Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-f6v4-cf5j-vf3w","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv","Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx","Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v","Warn: Project is vulnerable to: GHSA-3787-6prv-h9w3","Warn: Project is vulnerable to: GHSA-9qxr-qj54-h672","Warn: Project is vulnerable to: GHSA-m4v8-wqvr-p9f7","Warn: Project is vulnerable to: GHSA-c76h-2ccp-4975","Warn: Project is vulnerable to: GHSA-cxrh-j4jr-qwg3","Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q","Warn: Project is vulnerable to: GHSA-7q7g-4xm8-89cq","Warn: Project is vulnerable to: GHSA-7v5v-9h63-cj86","Warn: Project is vulnerable to: GHSA-gx9m-whjm-85jf","Warn: Project is vulnerable to: GHSA-mmhx-hmjr-r674","Warn: Project is vulnerable to: GHSA-vhxf-7vqr-mrjg","Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99","Warn: Project is vulnerable to: GHSA-f7f6-9jq7-3rqj","Warn: Project is vulnerable to: GHSA-3wc5-fcw2-2329","Warn: Project is vulnerable to: GHSA-64fm-8hw2-v72w","Warn: Project is vulnerable to: GHSA-cvr6-37gx-v8wc","Warn: Project is vulnerable to: GHSA-f98w-7cxr-ff2h","Warn: Project is vulnerable to: GHSA-cg87-wmx4-v546","Warn: Project is vulnerable to: GHSA-m4gq-x24j-jpmf","Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55","Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j","Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg","Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm","Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36","Warn: Project is vulnerable to: GHSA-3mv9-4h5g-vhg3","Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25","Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx","Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6","Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj","Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x","Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc","Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx","Warn: Project is vulnerable to: GHSA-8cf7-32gw-wr33","Warn: Project is vulnerable to: GHSA-hjrf-2m68-5959","Warn: Project is vulnerable to: GHSA-qwph-4952-7xr6","Warn: Project is vulnerable to: GHSA-5v2h-r2cx-5xgj","Warn: Project is vulnerable to: GHSA-rrrm-qjm4-v8hf","Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3","Warn: Project is vulnerable to: GHSA-44fp-w29j-9vj5","Warn: Project is vulnerable to: GHSA-4pg4-qvpc-4q3h","Warn: Project is vulnerable to: GHSA-g5hg-p3ph-g8qg","Warn: Project is vulnerable to: GHSA-fjgf-rc76-4x9p","Warn: Project is vulnerable to: GHSA-76c9-3jph-rj3q","Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp","Warn: Project is vulnerable to: GHSA-9rhg-254w-fh9x","Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw","Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg","Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p","Warn: Project is vulnerable to: GHSA-w5hq-hm5m-4548","Warn: Project is vulnerable to: GHSA-52f5-9888-hmc6","Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3","Warn: Project is vulnerable to: GHSA-x574-m823-4x7w","Warn: Project is vulnerable to: GHSA-4r4m-qw57-chr8","Warn: Project is vulnerable to: GHSA-xcj6-pq6g-qj4x","Warn: Project is vulnerable to: GHSA-356w-63v5-8wf4","Warn: Project is vulnerable to: GHSA-859w-5945-r5v3"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-21T08:45:43.420Z","repository_id":36950958,"created_at":"2025-08-21T08:45:43.420Z","updated_at":"2025-08-21T08:45:43.420Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344836268,"owners_count":38330096,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-15T02:00:06.843Z","response_time":105,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-coding","ai-tools","commerce","e-commerce","ecommerce","framework","javascript","medusa","nodejs","react","typescript"],"created_at":"2024-07-30T17:01:11.004Z","updated_at":"2026-10-18T21:20:23.554Z","avatar_url":"https://github.com/medusajs.png","language":"TypeScript","funding_links":["https://github.com/sponsors/medusajs"],"categories":["TypeScript","JavaScript","Projects using `@faker-js/faker`","Development Products","framework","ECommerce platform","react","typescript","Uncategorized","Web","E-Commerce \u0026 Business","🛠 Part I: The Open SaaS Stack","Other Platforms \u0026 Open-source Engines","E-commerce","🤖 AI \u0026 Machine Learning"],"sub_categories":["Uncategorized","Web Frameworks","E-Commerce \u0026 Search","Guides \u0026 Articles","Shopify"],"readme":"\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://www.medusajs.com\"\u003e\n  \u003cpicture\u003e\n    \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://user-images.githubusercontent.com/59018053/229103275-b5e482bb-4601-46e6-8142-244f531cebdb.svg\"\u003e\n    \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://user-images.githubusercontent.com/59018053/229103726-e5b529a3-9b3f-4970-8a1f-c6af37f087bf.svg\"\u003e\n    \u003cimg alt=\"Medusa logo\" src=\"https://user-images.githubusercontent.com/59018053/229103726-e5b529a3-9b3f-4970-8a1f-c6af37f087bf.svg\"\u003e\n    \u003c/picture\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\u003ch1 align=\"center\"\u003e\n  Medusa\n\u003c/h1\u003e\n\n\u003ch4 align=\"center\"\u003e\n  \u003ca href=\"https://docs.medusajs.com\"\u003eDocumentation\u003c/a\u003e |\n  \u003ca href=\"https://www.medusajs.com\"\u003eWebsite\u003c/a\u003e\n\u003c/h4\u003e\n\n\u003cp align=\"center\"\u003e\n  Building blocks for digital commerce\n\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/medusajs/medusa/blob/develop/LICENSE\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/license-MIT-blue.svg\" alt=\"Medusa is released under the MIT license.\" /\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/medusajs/medusa/blob/develop/CONTRIBUTING.md\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat\" alt=\"PRs welcome!\" /\u003e\n  \u003c/a\u003e\n \u003cp align=\"center\"\u003e\n  \u003ca href=\"https://twitter.com/intent/follow?screen_name=medusajs\"\u003e\n    \u003cimg src=\"https://img.shields.io/twitter/follow/medusajs.svg?label=Follow%20@medusajs\" alt=\"Follow @medusajs\" /\u003e\n  \u003ca href=\"https://discord.gg/medusajs\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/chat-on%20discord-7289DA.svg\" alt=\"Discord Chat\" /\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n## Getting Started\n\nVisit the [Documentation](https://docs.medusajs.com/learn) to set up a Medusa application.\n\n## What is Medusa\n\nMedusa is an ecommerce platform with a built-in framework for customization that allows you to build custom commerce applications without reinventing core commerce logic. The framework and modules can be used to build advanced B2B or DTC ecommerce stores, marketplaces, PoS systems, service businesses, or any product that needs foundational commerce primitives. All commerce modules are open-source and freely available on npm.\n\nLearn more about [Medusa’s architecture](https://docs.medusajs.com/learn/advanced-development/architecture/overview) and [commerce modules](https://docs.medusajs.com/resources/commerce-modules) in the Docs.\n\n## Upgrades \u0026 Integrations\n\nFollow the [Release Notes](https://github.com/medusajs/medusa/releases) to keep your Medusa project up-to-date.\n\nCheck out all [available Medusa integrations](https://docs.medusajs.com/resources/integrations).\n\n## Community \u0026 Contributions\n\nThe community and core team are available in [GitHub Discussions](https://github.com/medusajs/medusa/discussions), where you can ask for support, discuss roadmap, and share ideas.\n\nOur [Contribution Guide](https://github.com/medusajs/medusa/blob/develop/CONTRIBUTING.md) describes how to contribute to the codebase and Docs.\n\nJoin our [Discord server](https://discord.com/invite/medusajs) to meet other community members.\n\n## Other channels\n\n- [GitHub Issues](https://github.com/medusajs/medusa/issues)\n- [Community Discord](https://discord.gg/medusajs)\n- [Twitter](https://twitter.com/medusajs)\n- [LinkedIn](https://www.linkedin.com/company/medusajs)\n- [Medusa Blog](https://medusajs.com/blog/)\n\n## License\n\nLicensed under the [MIT License](https://github.com/medusajs/medusa/blob/develop/LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmedusajs%2Fmedusa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmedusajs%2Fmedusa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmedusajs%2Fmedusa/lists"}