Repositories list

• malicious-packages

  Public
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •24•272•12•10•Updated Dec 25, 2024Dec 25, 2024

• criticality_score

  Public
  Gives criticality score for an open source project

  Go

  •

  Apache License 2.0

  •120•1.3k•41•33•Updated Dec 25, 2024Dec 25, 2024

• scorecard-webapp

  Public
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  HTML

  •

  Apache License 2.0

  •27•23•31•13•Updated Dec 24, 2024Dec 24, 2024

• scorecard-action

  Public
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2github-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •72•272•27•4•Updated Dec 23, 2024Dec 23, 2024

• fuzz-introspector

  Public
  Fuzz Introspector -- introspect, extend and optimise fuzzers

  testingsecurityfuzz-testing+ 3vulnerability-analysissecurity-researchfuzzing

  Python

  •

  Apache License 2.0

  •59•387•96•3•Updated Dec 23, 2024Dec 23, 2024

• scorecard

  Public
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •508•4.7k•340•4•Updated Dec 23, 2024Dec 23, 2024

• allstar

  Public
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •124•1.3k•67•2•Updated Dec 23, 2024Dec 23, 2024

• scorecard-visualizer

  Public
  Tool for visualizing the Open SSF Scorecard Api data in a human friendly way

  openssfopenssf-scorecard

  TypeScript

  •

  Apache License 2.0

  •3•13•1•21•Updated Dec 23, 2024Dec 23, 2024

• security-baseline

  Public
  Go

  •

  Apache License 2.0

  •11•10•29•17•Updated Dec 20, 2024Dec 20, 2024

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •51•767•59•12•Updated Dec 20, 2024Dec 20, 2024

• wg-globalcyberpolicy

  Public
  Global Cyber Policy Working Group

  Apache License 2.0

  •3•3•2•0•Updated Dec 19, 2024Dec 19, 2024

• wg-dei

  Public
  The Diversity, Equity, and Inclusion Working Group mission is to increase representation and strengthen the overall effectiveness of the cybersecurity workforce.

  Apache License 2.0

  •1•6•6•2•Updated Dec 18, 2024Dec 18, 2024

• wg-best-practices-os-developers

  Public
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •139•791•56•14•Updated Dec 17, 2024Dec 17, 2024

• ossf-landscape

  Public
  Apache License 2.0

  •26•27•1•0•Updated Dec 17, 2024Dec 17, 2024

• sbom-everywhere

  Public
  Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption

  Vue

  •

  Apache License 2.0

  •26•76•25•2•Updated Dec 15, 2024Dec 15, 2024

• tac

  Public
  Technical Advisory Council

  Other

  •60•111•24•7•Updated Dec 12, 2024Dec 12, 2024

• osv-schema

  Public
  Open Source Vulnerability schema.

  Python

  •

  Apache License 2.0

  •85•189•28•11•Updated Dec 10, 2024Dec 10, 2024

• secure-sw-dev-fundamentals

  Public
  Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

  CSS

  •

  Creative Commons Attribution 4.0 International

  •48•185•34•1•Updated Dec 10, 2024Dec 10, 2024

• alpha-omega

  Public
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •52•86•51•1•Updated Dec 9, 2024Dec 9, 2024

• census

  Public
  📜Automated review of open source software projects

  censusstatisticsoss+ 2analysismetrics

  HTML

  •

  Other

  •30•116•25•1•Updated Dec 6, 2024Dec 6, 2024

• glossary

  Public
  JavaScript

  •

  Apache License 2.0

  •1•1•0•1•Updated Dec 5, 2024Dec 5, 2024

• Memory-Safety

  Public
  Apache License 2.0

  •12•21•6•0•Updated Dec 4, 2024Dec 4, 2024

• package-feeds

  Public
  Feed parsing for language package manager updates

  Go

  •

  Apache License 2.0

  •24•75•21•12•Updated Dec 4, 2024Dec 4, 2024

• wg-vulnerability-disclosures

  Public
  The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.

  Apache License 2.0

  •41•183•26•0•Updated Nov 25, 2024Nov 25, 2024

• artwork

  Public
  OpenSSF Artwork

  Apache License 2.0

  •8•8•0•1•Updated Nov 5, 2024Nov 5, 2024

• wg-securing-software-repos

  Public
  OpenSSF Working Group on Securing Software Repositories

  Other

  •19•94•6•4•Updated Oct 28, 2024Oct 28, 2024

• ai-ml-security

  Public
  Potential WG on Artificial Intelligence and Machine Learning (AI/ML)

  Apache License 2.0

  •10•57•3•0•Updated Oct 23, 2024Oct 23, 2024

• wg-securing-critical-projects

  Public
  Helping allocate resources to secure the critical open source projects we all depend on.

  Apache License 2.0

  •40•334•22•0•Updated Oct 10, 2024Oct 10, 2024

• security-insights-spec

  Public
  OPENSSF SECURITY INSIGHTS: Repository for development of the draft standard, where requests for modification should be made via Github Issues.

  Other

  •10•52•14•3•Updated Sep 5, 2024Sep 5, 2024

• s2c2f

  Public
  The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.

  Other

  •25•194•5•1•Updated Aug 27, 2024Aug 27, 2024