scorecard
OpenSSF Scorecard - Security health metrics for Open Source
Tech stack & purpose
OpenSSF Scorecard is a tool that evaluates the security health of open-source projects by running automated checks and probes against repository code. Built in Go, the project uses a probe-based architecture where individual heuristics assess distinct security behaviors, and results can be annotated by maintainers through a `scorecard.yml` configuration file. The project includes scorecard-attestor, a tool that integrates with Google Cloud Build and binary authorization to enforce security policies on deployments, supporting policies around binary artifacts, known vulnerabilities, pinned dependencies, and code review requirements. OpenSSF Scorecard is maintained by the Open Source Security Foundation and provides infrastructure for continuous security assessment, including cron jobs, Kubernetes deployments, and local testing emulators.
Community & reference links
Languages
Contributors (top 30 of 199)
- dependabot[bot]1,169 commits · 0 followers
- Azeem Shaikh262 commits
- Spencer Schrock261 commits
- laurentsimon252 commits
- Naveen189 commits · 197 followers
- naveen170 commits
- Abhishek Arya93 commits
- Chris McGehee58 commits
- AdamKorcz45 commits
- Dan Lorenc38 commits
- raghavkaul30 commits
- Raghav Kaul30 commits
- naveensrinivasan25 commits
- Kim Lewandowski19 commits
- David A. Wheeler19 commits
- Jamie Magee15 commits
- olivekl14 commits
- Stephen Augustus14 commits
- Evgeny Vereshchagin13 commits
- Gabriela Gutierrez13 commits
- Aiden Wang12 commits
- afmarcum11 commits
- Martin Costello11 commits
- Stephen Augustus (he/him)11 commits
- dlorenc11 commits
- asraa10 commits
- Arnout Engelen9 commits
- Arnaud J Le Hors7 commits
- Avishay Balter7 commits
- Caleb Brown7 commits
