Scorecard checks whether dependencies used in build and release (in Dockerfiles, shell scripts and GitHub workflows) are pinned to an immutable hash rather than a mutable tag or version range; full Go module semantic versions count as pinned because Go verifies downloads against recorded hashes. Pinning supports reproducibility and resists compromised later versions and dependency confusion, but must be paired with an update tool so pins do not go stale.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.