OpenSSF Scorecard - Security health metrics for Open Source
We created Scorecard to help open source maintainers improve their security best practices and to help open source consumers judge whether their dependencies are safe.
Scorecard is an automated tool that assesses a number of important heuristics ("checks") associated with software security and assigns each check a score of 0-10. You can use these scores to understand specific areas to improve in order to strengthen the security posture of your project. You can also assess the risks that dependencies introduce, and make informed decisions about accepting these risks, evaluating alternative solutions, or working with the maintainers to make improvements.
The inspiration for Scorecard’s logo: "You passed! All D's ... and an A!"
Automate analysis and trust decisions on the security posture of open source projects.
Use this data to proactively improve the security posture of the critical projects the world depends on.
Act as a measurement tool for existing policies
If OSS consumers require certain behaviors from their dependencies,
Scorecard can be used to measure those. With the V5 release, we see
Structured Results as a way of doing this if there is a supported analysis.
Instead of relying on an aggregate score of X/10, or a Maintained score of
Y/10, an OSS consumer may want to ensure the repo they're depending on
isn't archived (which is covered by the archived probe). The OpenSSF
takes this approach with its own Security Baseline for projects.
To be a definitive report or requirement that all projects should follow.
Scorecard is not intended to be a one-size-fits-all solution. Every step of making our results is opinionated: what checks get included or excluded, the importance of each check, and how scores are calculated. The checks themselves are heuristics; there are false positives and false negatives.
Whether it’s due to applicability, or feasibility, or a matter of opinion, what's included or excluded from Scorecard results leads to a lot of discussion. It’s impossible to create a Scorecard that satisfies everyone because different audiences will care about different subsets of behavior.
Aggregate scores in particular tells you nothing about what individual behaviors a repository is or is not doing. Many check scores are aggregated into a single score, and there’s multiple ways of arriving at the same score. These scores change as we add new heuristics or refine the existing ones.
Scorecard has been run on thousands of projects to monitor and track security metrics. Prominent projects that use Scorecard include:
To see scores for projects regularly scanned by Scorecard, navigate to the webviewer. You can also replace the placeholder text (platform, user/org, and repository name) in the following template link to generate a custom Scorecard link for a repo:
https://scorecard.dev/viewer/?uri=<github_or_gitlab>.com/<user_name_or_org>/<repository_name>
For example:
To view scores for projects not included in the webviewer, use the Scorecard CLI.
Scorecard scans more than 1.3 million repositories every week, from
ossf/scorecard-infra. Results are
available through the REST API. The BigQuery public
dataset is no longer available; see
Scorecard Infrastructure Changes
for details.
To add a project to the weekly scan, follow the instructions in
ossf/scorecard-infra's contributing guide.
The easiest way to use Scorecard on GitHub projects you own is with the Scorecard GitHub Action. The Action runs on any repository change and issues alerts that maintainers can view in the repository’s Security tab. For more information, see the Scorecard GitHub Action installation instructions.
