Repositories list

• malicious-packages

  Public
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •31•295•10•5•Updated Mar 8, 2025Mar 8, 2025

• ossf-landscape

  Public
  Apache License 2.0

  •26•27•1•2•Updated Mar 8, 2025Mar 8, 2025

• scorecard-action

  Public
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2github-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •72•283•26•0•Updated Mar 8, 2025Mar 8, 2025

• wg-best-practices-os-developers

  Public
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •150•826•55•9•Updated Mar 7, 2025Mar 7, 2025

• security-baseline

  Public
  Go

  •

  Apache License 2.0

  •18•59•17•1•Updated Mar 7, 2025Mar 7, 2025

• scorecard-visualizer

  Public
  Tool for visualizing the Open SSF Scorecard Api data in a human friendly way

  openssfopenssf-scorecard

  TypeScript

  •

  Apache License 2.0

  •5•14•1•10•Updated Mar 7, 2025Mar 7, 2025

• criticality_score

  Public
  Gives criticality score for an open source project

  Go

  •

  Apache License 2.0

  •120•1.4k•43•35•Updated Mar 7, 2025Mar 7, 2025

• osv-schema

  Public
  Open Source Vulnerability schema.

  Python

  •

  Apache License 2.0

  •91•194•28•9•Updated Mar 7, 2025Mar 7, 2025

• secure-sw-dev-fundamentals

  Public
  Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

  CSS

  •

  Creative Commons Attribution 4.0 International

  •49•191•34•2•Updated Mar 6, 2025Mar 6, 2025

• Memory-Safety

  Public
  Apache License 2.0

  •12•22•6•0•Updated Mar 6, 2025Mar 6, 2025

• scorecard-webapp

  Public
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  HTML

  •

  Apache License 2.0

  •27•23•31•8•Updated Mar 6, 2025Mar 6, 2025

• fuzz-introspector

  Public
  Fuzz Introspector -- introspect, extend and optimise fuzzers

  testingsecurityfuzz-testing+ 3vulnerability-analysissecurity-researchfuzzing

  Python

  •

  Apache License 2.0

  •64•403•98•0•Updated Mar 6, 2025Mar 6, 2025

• alpha-omega

  Public
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •54•90•52•2•Updated Mar 5, 2025Mar 5, 2025

• tac

  Public
  Technical Advisory Council

  Other

  •61•118•27•9•Updated Mar 5, 2025Mar 5, 2025

• allstar

  Public
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •125•1.3k•70•9•Updated Mar 5, 2025Mar 5, 2025

• scorecard

  Public
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •519•4.8k•347•9•Updated Mar 3, 2025Mar 3, 2025

• sbom-everywhere

  Public
  Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption

  Vue

  •

  Apache License 2.0

  •28•82•26•4•Updated Mar 3, 2025Mar 3, 2025

• glossary

  Public
  JavaScript

  •

  Apache License 2.0

  •1•1•0•2•Updated Mar 3, 2025Mar 3, 2025

• security-insights-spec

  Public
  Machine-readable specification for the attestation of security-relevant data.

  CUE

  •

  Other

  •10•57•3•1•Updated Mar 2, 2025Mar 2, 2025

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •55•821•60•10•Updated Mar 1, 2025Mar 1, 2025

• wg-dei

  Public
  The BEAR (Belonging, Empowerment, Allyship, and Representation) WG, formerly DEI, was formed in December 2023 to enhance representation and cybersecurity workforce effectiveness.

  Apache License 2.0

  •2•6•5•2•Updated Mar 1, 2025Mar 1, 2025

• wg-globalcyberpolicy

  Public
  Global Cyber Policy Working Group

  Apache License 2.0

  •7•32•5•0•Updated Feb 28, 2025Feb 28, 2025

• wg-vulnerability-disclosures

  Public
  The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.

  Apache License 2.0

  •41•186•25•0•Updated Feb 25, 2025Feb 25, 2025

• scorecard-monitor

  Public
  Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

  securitysecurity-auditsecurity-tools+ 3github-actionsopen-source-managementopenssf-scorecard

  JavaScript

  •

  Apache License 2.0

  •14•33•13•6•Updated Feb 15, 2025Feb 15, 2025

• community

  Public
  Creative Commons Attribution 4.0 International

  •5•8•3•2•Updated Feb 5, 2025Feb 5, 2025

• s2c2f

  Public
  The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.

  Other

  •26•200•6•0•Updated Jan 31, 2025Jan 31, 2025

• .github

  Public
  Github configuration

  4•1•0•1•Updated Jan 29, 2025Jan 29, 2025

• foundation

  Public
  OpenSSF Governance and Legal Docs

  Apache License 2.0

  •19•72•0•1•Updated Jan 21, 2025Jan 21, 2025

• oss-vulnerability-guide

  Public
  A guide on coordinated vulnerability disclosure for open source projects. Includes templates for security policies (security.md) and disclosure notifications.

  Creative Commons Attribution 4.0 International

  •47•119•4•0•Updated Jan 16, 2025Jan 16, 2025

• si-tooling

  Public
  Python

  •

  Apache License 2.0

  •2•3•0•1•Updated Jan 4, 2025Jan 4, 2025