-
Notifications
You must be signed in to change notification settings - Fork 565
Closed
Labels
Description
Describe the bug
Projects that are fuzzed with OSS-Fuzz might not be detected due to a capitalization mismatch between their official repo URL and what's stored in its project.yml
in the oss-fuzz repo.
Reproduction steps
Steps to reproduce the behavior:
- Note that FFTW/fftw3 gets a 0/10 for fuzzing: https://securityscorecards.dev/viewer/?uri=github.com/FFTW/fftw3
- However, it is actually fuzzed by oss-fuzz: https://github.com/google/oss-fuzz/tree/master/projects/fftw3
- However, its
project.yml
has its org-name in lowercase: https://github.com/google/oss-fuzz/blob/master/projects/fftw3/project.yaml
Expected behavior
Given that usernames and repo names are case-insensitive (on GitHub, at least... not sure about other platforms), the scan should also be.