# ossf/scorecard

OpenSSF Scorecard - Security health metrics for Open Source

Repository: https://github.com/ossf/scorecard
Canonical: https://ross.abutalabs.com/products/scorecard
Homepage: https://scorecard.dev
Language: Go
License: Apache-2.0
License Family: permissive
Topics: scorecard, openssf-scorecard
Last push: 2026-08-24T08:24:59+00:00

## Health v2 (maintenance only)
Score: 88/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 68, longevity 100
- inputs: {"age_days": 2154, "days_push": 9, "days_rel": 132, "gap_med": 72.0, "n_releases_24m": 7}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5653, forks 708 (observed 2026-08-28T04:09:27.146011+00:00)

## What it is
OpenSSF Scorecard is an automated tool that scores open source projects on security best practices through a series of checks. It can be run via CLI, a GitHub Action, or a REST API to help maintainers improve security habits and consumers evaluate dependency risk.

## Use cases
- assess security health of an open source repository
- check if my dependencies follow security best practices
- add automated security scoring to my CI pipeline
- generate a security scorecard badge for my repo
- audit a third-party GitHub project for risky practices
- find and fix missing security practices in my repository

## When to choose
- you want automated, standardized security posture scoring for GitHub-hosted projects
- you need supply-chain risk signals for choosing open source dependencies
- you want a GitHub Action that continuously checks your repo's security practices

## When to avoid
- you need deep code vulnerability scanning rather than practice/policy checks
- your project is not hosted on a supported forge like GitHub
- you need runtime security monitoring instead of repository hygiene assessment

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, ci-cd, developer-tools
- domain: security, developer-tools
- platform: cli, windows
- tags: openssf, supply-chain-security, security-health-metrics, github-action, repository-scanning, best-practices, open-source, automation, linux, macos, docker, github

## Member repositories
- ossf/scorecard (main) score 88

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:27.146011+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:55:15.922590+00:00, confidence not recorded.
  - readme: https://github.com/ossf/scorecard (fetched 2026-08-28T04:09:27.146011+00:00, sha 707c40f86e1e)
  - homepage: https://scorecard.dev (fetched 2026-08-29T08:49:38.871762+00:00, sha fecf336ff1a9)
- Data as of 2026-08-30T08:39:29.467469+00:00.