Trust and health report
determined - trust report
Sourced, dated trust signals - maintenance label posture, repository provenance, and security scan status. Not a composite safety grade.
GraphCanon updated 3w · GitHub synced 3w
Maintenance
Recency and activity heuristics from public GitHub metadata (maintenance label, momentum); methodology: github_public_v1.
Dormant18% signal
last push 501d ago · last release 1y
Provenance
Repository identity and fork provenance (github_public_v1).
- GitHub repo id: 253846879
- Not a fork
- Verified publisher: organization account
- Computed 3w
Security intelligence
Source-by-source security scan results from public intelligence providers. Missing, partial, or failed queries are shown explicitly and are not treated as clean.
OSV dependency advisories
Published findings- Last query
- 1mo
- Scanner
- osv@v1
- Stored findings
- 39
OpenSSF Scorecard
Not queried- Scanner
- openssf-scorecard@v1
Weekly public scans omit some checks at scale.
View source evidenceDependency advisories (deduplicated)
GHSA-3936-cmfr-pm3m
black@23.3.0 · osv@v1
requirements.txt
GHSA-fj7x-q9j7-g6q6
black@23.3.0 · osv@v1
requirements.txt
PYSEC-2024-48
black@23.3.0 · osv@v1
requirements.txt
GHSA-73jc-5mrq-prw7
sqlfluff@2.1.4 · osv@v1
requirements.txt
GHSA-wmhf-fqc8-vxhh
sqlfluff@2.1.4 · osv@v1
requirements.txt
PYSEC-2026-209
sqlfluff@2.1.4 · osv@v1
requirements.txt
PYSEC-2026-210
sqlfluff@2.1.4 · osv@v1
requirements.txt
GHSA-5rjg-fvgr-3xxf
setuptools@70.0.0 · osv@v1
requirements.txt
PYSEC-2025-49
setuptools@70.0.0 · osv@v1
requirements.txt
GO-2022-0635
github.com/aws/aws-sdk-go@v1.40.34 · osv@v1
go.sum
GO-2022-0646
github.com/aws/aws-sdk-go@v1.40.34 · osv@v1
go.sum
GHSA-w73w-5m7g-f7qc
github.com/dgrijalva/jwt-go@v3.2.0+incompatible · osv@v1
go.sum
GO-2020-0017
github.com/dgrijalva/jwt-go@v3.2.0+incompatible · osv@v1
go.sum
GHSA-4vq8-7jfc-9cvp
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GHSA-pxq6-2prw-chj9
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GHSA-rg2x-37c3-w2rh
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GHSA-vp62-88p7-qqf5
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GHSA-x744-4wpc-v9h2
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GHSA-x86f-5xw2-fm2r
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GO-2025-3829
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GO-2026-4883
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GO-2026-4887
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GO-2026-5617
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GO-2026-5668
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GO-2026-5746
github.com/docker/docker@v25.0.6+incompatible · osv@v1
go.sum
GHSA-78h2-9frx-2jm8
github.com/go-jose/go-jose/v3@v3.0.3 · osv@v1
go.sum
GHSA-c6gw-w398-hv78
github.com/go-jose/go-jose/v3@v3.0.3 · osv@v1
go.sum
GO-2025-3485
github.com/go-jose/go-jose/v3@v3.0.3 · osv@v1
go.sum
GO-2026-4945
github.com/go-jose/go-jose/v3@v3.0.3 · osv@v1
go.sum
GHSA-6xp3-p59p-q4fj
github.com/go-pg/pg/v10@v10.10.6 · osv@v1
go.sum
GO-2025-3764
github.com/go-pg/pg/v10@v10.10.6 · osv@v1
go.sum
GHSA-mh63-6h87-95cp
github.com/golang-jwt/jwt@v3.2.2+incompatible · osv@v1
go.sum
GO-2025-3553
github.com/golang-jwt/jwt@v3.2.2+incompatible · osv@v1
go.sum
GHSA-29wx-vh33-7x7r
github.com/golang-jwt/jwt/v4@v4.4.3 · osv@v1
go.sum
GO-2024-3250
github.com/golang-jwt/jwt/v4@v4.4.3 · osv@v1
go.sum
GHSA-jqcq-xjh3-6g23
github.com/jackc/pgproto3/v2@v2.3.3 · osv@v1
go.sum
GO-2026-4518
github.com/jackc/pgproto3/v2@v2.3.3 · osv@v1
go.sum
GHSA-j88v-2chj-qfwx
github.com/jackc/pgx/v4@v4.18.2 · osv@v1
go.sum
GO-2026-5004
github.com/jackc/pgx/v4@v4.18.2 · osv@v1
go.sum
Method and caveats: these are sourced, dated heuristics from public GitHub data and external security intelligence providers. A status like "no published findings from this source" is not a guarantee of safety. Read the full trust methodology · JSON report at /api/graphcanon/tools/determined-ai-determined/trust.
Common questions
- Is determined maintained?
- GraphCanon rates determined "Dormant" (18% maintenance signal from public GitHub metadata, computed 3w). Last push was 501 days ago. This is a recency heuristic, not a guarantee the project will stay maintained.
- Is determined safe to use?
- Last scanned 1mo (deps profile). Status: 39 low - 39 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify determined as safe - review maintenance, provenance, and scan findings on this page before adopting.
- Is determined a fork?
- No. determined is not flagged as a fork in GitHub metadata at the time of the last refresh.
- Does determined have known security vulnerabilities?
- Last scanned 1mo (deps profile). Status: 39 low - 39 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report.
- How often is the determined trust report updated?
- Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed 3w (methodology github_public_v1).
- What does GraphCanon never claim about determined?
- We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for determined. Signals are sourced heuristics with explicit limits - see trust methodology.
- How does GraphCanon assess trust for determined?
- Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read trust methodology for full scope and limits.