ossf/scorecard

View on GitHub ↗ ★ 5,805 Go

OpenSSF Scorecard - Security health metrics for Open Source

15 mentions on Hacker News by 13 people: 4 stories, 11 comments · first 2020-11-10 · latest 2025-06-27

Mentions per year 15 mentions · busiest year 2020 (4)

20082026

All Stories Comments Newest Top Oldest

…cli tool or you run it as a github action), one of the checks it performs is "Pinned-Dependencies": https://github.com/ossf/scorecard/blob/main/docs/checks.md#p... . Checks that fail generate an security alert under Security -> Code…
comment by wereHamster · 2025-06-11 · in Bypassing GitHub Actions policies in the dumbest way possible
…flags dependencies (including GitHub actions) which aren’t pinned by hash https://scorecard.dev/ https://github.com/ossf/scorecard/blob/main/docs/checks.md#p...
comment by mcpherrinm · 2025-03-15 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
Scoring framework: https://securityscorecards.dev/ Code: https://github.com/ossf/scorecard April 2024 ranking of OSS projects by criticality, 100MB CSV: https://commondatastorage.googleapis.com/ossf-criticality-sc...
comment by transpute · 2024-05-06 · in Social engineering takeovers of open source projects
…like Google to pay maintainers/curators to focus more on security. [1] https://sos.dev/ [2] https://github.com/ossf/scorecard
comment by wyldfire · 2022-07-10 · in Congratulations: We now have opinions on your open source contributions
…if you are concerned about this, I'd suggest looking at the following: * OpenSSF Scorecard Action - https://github.com/ossf/scorecard#scorecards-github-action * Step Security Harden Action - https://github.com/step-security/harden-runner I…
comment by newman314 · 2022-04-28 · in Best practices to keep your projects secure on GitHub
…else! I helped start the Scorecards, SLSA, and Sigstore projects, which are all in the OpenSSF. https://github.com/ossf/scorecard https://slsa.dev/ https://www.sigstore.dev/
comment by dlor · 2022-02-06 · in Finding Vulnerabilities in Open Source Projects
I am maintainer of couple of OSS projects https://github.com/ossf/scorecard https://github.com/ossf/package-analysis These projects help with repository best practices and does some level of npm package analysis based on rules.
comment by snaveen · 2021-11-04 · in Ask HN: How do you security-audit external software using NPM packages?
…contribute to several other related efforts. Here's a non-exhaustive list: Security Scorecards ( https://github.com/ossf/scorecard ): auto-generated security checks for OSS, Criticality Score ( https://github.com/ossf/criticality_score ):…
comment by kimsterv · 2021-03-27 · in Open Source Security Foundation
there's an open issue related to this: https://github.com/ossf/scorecard/issues/27
comment by kimsterv · 2020-11-11 · in Security scorecards for open source projects
…just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vulnerabilities, etc
comment by abharya · 2020-11-10 · in Security scorecards for open source projects
Yes, we will automate score capturing over all projects in real-time in the future. https://github.com/ossf/scorecard/issues/12 The work to capture current vuln state is tracked in https://github.com/ossf/scorecard/issues/52
comment by abharya · 2020-11-10 · in Security scorecards for open source projects