[arikfr]

Enrol projects/redash

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

Context: Redash is an open-source data visualization and dashboarding tool (BSD-2-Clause, ~29k stars, ~4.6k forks, since 2013) that is self-hosted by many organizations and holds credentials for their databases. security@redash.io is the contact in SECURITY.md.

Note: .oss-scanner/Dockerfile and .oss-scanner/threat_model.md are added to the Redash repo in getredash/redash#7903; please merge this after that one lands. The image was built and tests were run with --network none locally.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/redash

Repository: getredash/redash at master · opened by arikfr

	Check	Result
✅	Repository	created 13 years ago, last push today
ℹ️	Stars / forks	28,859 stars · 4,633 forks · 560 watching
ℹ️	Outside participants	44 people from outside the project opened 58 of the last 100 issues and pull requests
ℹ️	Criticality score	0.72 on the OpenSSF scale of 0 to 1 signals created_since 158, updated_since 0, contributor_count 554, org_count 9, commit_frequency 2.3, recent_releases_count 2, closed_issues_count 117, updated_issues_count 176, comment_frequency 1.7, dependents_count 10,061
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm
✅	License	BSD-2-Clause
✅	Opened by an active maintainer	member of the owning organisation; 55 commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	security@redash.io is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
❌	.oss-scanner/ in the repository	not present; no threat model (optional); no Dockerfile at .oss-scanner/Dockerfile on master
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[arikfr]

I have read the CLA Document and I hereby sign the CLA.

[arikfr]

I've added .oss-scanner/ in the repository (after the automated check...).