ossf

OpenSSF Scorecard - Security health metrics for Open Source

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and...

Gives criticality score for an open source project

GitHub App to set and enforce security policies

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

Open Source Package Analysis

A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

Fuzz Introspector -- introspect, extend and optimise fuzzers

Official GitHub Action for OpenSSF Scorecard.

Helping allocate resources to secure the critical open source projects we all depend on.

OpenSSF Security Tooling Working Group

Open Source Vulnerability schema.

The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to...

The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability...

The purpose of the Metrics & Metadata (formerly Identifying Security Threats) working group is to enable stakeholders to have informed confidence in the security of open source projects. We do...

Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the code they maintain, produce and use.

Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

Working Group on Artificial Intelligence and Machine Learning (AI/ML) Security

Cyber Reasoning Systems for Bug-Finding and Patching in Open Source Software

Collection of security best practices for package managers.

Technical Advisory Council

Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

Global Cyber Policy Working Group

OpenSSF Working Group on Securing Software Repositories

📜Automated review of open source software projects

Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption

A community collection of security reviews of open source software components.

Feed parsing for language package manager updates

Machine-readable specification for the attestation of security-relevant data.

OpenSSF Governance and Legal Docs

Collect, curate, and communicate relevant security metrics for open source projects.

The Great Multi-Factor Authentication (MFA) Distribution Project of the Open Source Security Foundation (OpenSSF). We work to distribute hardware MFA tokens to critical open source software (OSS)...

Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts