Hey,
I'm Erasmus, founder of Nucleus Verify โ a tool that scans open source
repositories and produces cryptographically signed verification certificates.
Before anything else โ we're a legitimate UK company (Alter Menta Technologies
Ltd, reg. 17036841, London). You can check us out here:
๐ altermenta.com
๐ github.com/Alter-Menta-Technologies
๐ฆ x.com/AlterMenta
๐ผ linkedin.com/company/alter-menta-technologies
Here's what happened: we automatically scan public GitHub repositories as part
of our open source verification programme and notify maintainers with what we
find. No one submitted your repo โ our engine found it and scanned it because
it's public.
We scanned gccrs and found 215 security issues worth knowing about.
Here's a summary of what we found:
[MEDIUM] GitHub Action not pinned to SHA โ pin to full commit hash
.forgejo/workflows/build-containers.yaml:32
[MEDIUM] GitHub Action not pinned to SHA โ pin to full commit hash
.forgejo/workflows/format-checks.yaml:20
[MEDIUM] GitHub Action not pinned to SHA โ pin to full commit hash
.github/workflows/Remark.yml:18
+ 212 more in full report
You can view the full results here โ no login required:
https://altermenta.com/check/7e580f4240a149f6
What is Nucleus Verify exactly?
Most security tools tell you what vulnerabilities exist. Nucleus does that too
โ and then produces a cryptographically signed, independently replayable proof
pack tied to your specific commit. Same hash every time. Any third party can
verify it without trusting us.
It's designed for developers who want honest verification, and for teams in
regulated industries (fintech, healthcare, defence) where audit-ready evidence
of code review is increasingly required by law (DORA, FCA, SOC 2).
The scan of gccrs was free. Viewing your results is free. No account required.
If you'd like the full report, proof pack download, and compliance mapping โ
those are on our paid plans starting at $20/month. But there's no pressure โ
the free results are genuinely useful on their own.
Want to add Nucleus to your CI/CD pipeline?
github.com/marketplace/actions/nucleus-verify
If you'd rather not hear from us again, just click below โ no hard feelings:
Unsubscribe:
https://altermenta.com/unsubscribe?token=117a6b57279c23e3bd5392ec1c29c704bf9b24f024e4866cc630b9ab99e7e1e5&[email protected]
Erasmus
Founder, Alter Menta Technologies
altermenta.com ยท Reg. 17036841 ยท London, EC1V 2NX
