GraphCanon rates envd "Steady" (60% maintenance signal from public GitHub metadata, computed Sep 18, 2026). Last push was 55 days ago. This is a recency heuristic, not a guarantee the project will stay maintained.

Last scanned Sep 18, 2026 (deps profile). Status: 53 low - 53 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify envd as safe - review maintenance, provenance, and scan findings on this page before adopting.

No. envd is not flagged as a fork in GitHub metadata at the time of the last refresh.

Does envd have known security vulnerabilities?

Last scanned Sep 18, 2026 (deps profile). Status: 53 low - 53 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report.

How often is the envd trust report updated?

Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed Sep 18, 2026 (methodology github_public_v1).

What does GraphCanon never claim about envd?

We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for envd. Signals are sourced heuristics with explicit limits - see trust methodology (https://www.graphcanon.com/trust-methodology).

How does GraphCanon assess trust for envd?

Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read trust methodology (https://www.graphcanon.com/trust-methodology) for full scope and limits.

Home/envd/Trust report

Trust and health report

envd - trust report

Sourced, dated trust signals - maintenance label posture, repository provenance, and security scan status. Not a composite safety grade.

GraphCanon updated Sep 20, 2026 · GitHub synced Sep 20, 2026

39views this month

Maintenance

Recency and activity heuristics from public GitHub metadata (maintenance label, momentum); methodology: github_public_v1.

Steady60% signal

last push 55d ago · last release Feb 7, 2026

+16 stars (30d) · +2 open issues (30d)

Provenance

Repository identity and fork provenance (github_public_v1).

GitHub repo id: 480303698
Not a fork
Verified publisher: organization account
Computed Sep 18, 2026

Security intelligence

Source-by-source security scan results from public intelligence providers. Missing, partial, or failed queries are shown explicitly and are not treated as clean.

OSV dependency advisories

Published findings

Last query: Sep 18, 2026
Scanner: osv@v1
Stored findings: 53

View source evidence

deps.dev advisories

Not queried

Scanner: deps.dev@v1

View source evidence

OpenSSF Scorecard

Not queried

Scanner: openssf-scorecard@v1

Weekly public scans omit some checks at scale.

View source evidence

Dependency advisories (deduplicated)

GHSA-xmrv-pmrh-hhx2

github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2 · osv@v1

go.sum

GO-2026-5764

github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2 · osv@v1

go.sum

GHSA-33vj-92qq-66hc

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GHSA-cvxm-645q-p574

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GHSA-fqw6-gf59-qr4w

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GHSA-jpcc-p29g-p8mq

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GHSA-rgh6-rfwx-v388

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GHSA-xhf5-7wjv-pqxp

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GO-2026-5064

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GO-2026-5338

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GO-2026-5378

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GO-2026-5475

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GO-2026-5622

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GO-2026-5758

github.com/containerd/containerd/v2@v2.1.5 · osv@v1

go.sum

GHSA-p436-gjf2-799p

github.com/docker/cli@v28.5.1+incompatible · osv@v1

go.sum

GO-2026-4610

github.com/docker/cli@v28.5.1+incompatible · osv@v1

go.sum

GHSA-pxq6-2prw-chj9

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GHSA-rg2x-37c3-w2rh

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GHSA-vp62-88p7-qqf5

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GHSA-x86f-5xw2-fm2r

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GO-2026-4883

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GO-2026-4887

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GO-2026-5617

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GO-2026-5668

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GO-2026-5746

github.com/docker/docker@v28.5.1+incompatible · osv@v1

go.sum

GHSA-m3xc-h892-ggx6

github.com/go-git/go-billy/v5@v5.6.2 · osv@v1

go.sum

GHSA-qw64-3x98-g7q2

github.com/go-git/go-billy/v5@v5.6.2 · osv@v1

go.sum

GO-2026-5490

github.com/go-git/go-billy/v5@v5.6.2 · osv@v1

go.sum

GO-2026-5597

github.com/go-git/go-billy/v5@v5.6.2 · osv@v1

go.sum

GHSA-37cx-329c-33x3