Hacker GitHub

← All repos

ossf/scorecard

View on GitHub ↗ ★ 5,805 Go

OpenSSF Scorecard - Security health metrics for Open Source

15 mentions on Hacker News by 13 people: 4 stories, 11 comments · first 2020-11-10 · latest 2025-06-27

Mentions per year 15 mentions · busiest year 2020 (4)
20082026
AllStoriesComments NewestTopOldest
  1. ▲ 13
    Show HN: Shouldiuse.dev – Software dependency health checker
    story by louis_w_gk · 2025-06-27 · 16 comments
  2. …cli tool or you run it as a github action), one of the checks it performs is "Pinned-Dependencies": https://github.com/ossf/scorecard/blob/main/docs/checks.md#p... . Checks that fail generate an security alert under Security -> Code…
    comment by wereHamster · 2025-06-11 · in Bypassing GitHub Actions policies in the dumbest way possible
  3. …flags dependencies (including GitHub actions) which aren’t pinned by hash https://scorecard.dev/ https://github.com/ossf/scorecard/blob/main/docs/checks.md#p...
    comment by mcpherrinm · 2025-03-15 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
  4. Scoring framework: https://securityscorecards.dev/ Code: https://github.com/ossf/scorecard April 2024 ranking of OSS projects by criticality, 100MB CSV: https://commondatastorage.googleapis.com/ossf-criticality-sc...
    comment by transpute · 2024-05-06 · in Social engineering takeovers of open source projects
  5. …like Google to pay maintainers/curators to focus more on security. [1] https://sos.dev/ [2] https://github.com/ossf/scorecard
    comment by wyldfire · 2022-07-10 · in Congratulations: We now have opinions on your open source contributions
  6. …if you are concerned about this, I'd suggest looking at the following: * OpenSSF Scorecard Action - https://github.com/ossf/scorecard#scorecards-github-action * Step Security Harden Action - https://github.com/step-security/harden-runner I…
    comment by newman314 · 2022-04-28 · in Best practices to keep your projects secure on GitHub
  7. …else! I helped start the Scorecards, SLSA, and Sigstore projects, which are all in the OpenSSF. https://github.com/ossf/scorecard https://slsa.dev/ https://www.sigstore.dev/
    comment by dlor · 2022-02-06 · in Finding Vulnerabilities in Open Source Projects
  8. I am maintainer of couple of OSS projects https://github.com/ossf/scorecard https://github.com/ossf/package-analysis These projects help with repository best practices and does some level of npm package analysis based on rules.
    comment by snaveen · 2021-11-04 · in Ask HN: How do you security-audit external software using NPM packages?
  9. ▲ 1
    Security health metrics for open source projects
    story by feross · 2021-07-06 · 0 comments
  10. ▲ 1
    Security Scorecards – Security Health Metrics for Open Source
    story by sam345 · 2021-07-02 · 0 comments
  11. …contribute to several other related efforts. Here's a non-exhaustive list: Security Scorecards ( https://github.com/ossf/scorecard ): auto-generated security checks for OSS, Criticality Score ( https://github.com/ossf/criticality_score ):…
    comment by kimsterv · 2021-03-27 · in Open Source Security Foundation
  12. ▲ 1
    Security Scorecards
    story by based2 · 2020-11-12 · 0 comments
  13. there's an open issue related to this: https://github.com/ossf/scorecard/issues/27
    comment by kimsterv · 2020-11-11 · in Security scorecards for open source projects
  14. …just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vulnerabilities, etc
    comment by abharya · 2020-11-10 · in Security scorecards for open source projects
  15. Yes, we will automate score capturing over all projects in real-time in the future. https://github.com/ossf/scorecard/issues/12 The work to capture current vuln state is tracked in https://github.com/ossf/scorecard/issues/52
    comment by abharya · 2020-11-10 · in Security scorecards for open source projects