ossf/scorecard

Health v2 · maintenance only

Adoption not part of the score

5653 stars · 708 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OpenSSF Scorecard is an automated tool that scores open source projects on security best practices through a series of checks. It can be run via CLI, a GitHub Action, or a REST API to help maintainers improve security habits and consumers evaluate dependency risk.

Use cases

• assess security health of an open source repository
• check if my dependencies follow security best practices
• add automated security scoring to my CI pipeline
• generate a security scorecard badge for my repo
• audit a third-party GitHub project for risky practices
• find and fix missing security practices in my repository

When to choose

• you want automated, standardized security posture scoring for GitHub-hosted projects
• you need supply-chain risk signals for choosing open source dependencies
• you want a GitHub Action that continuously checks your repo's security practices

When to avoid

• you need deep code vulnerability scanning rather than practice/policy checks
• your project is not hosted on a supported forge like GitHub
• you need runtime security monitoring instead of repository hygiene assessment

Facets

cli-tool · maturity active

security vulnerability-scanning ci-cd developer-tools security developer-tools cli windows openssf supply-chain-security security-health-metrics github-action repository-scanning best-practices open-source automation linux macos docker github

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ossf/scorecard")