How do you trust your open source software?
summary
Automated OpenSSF Scorecard runs 1.2 million weekly GitHub scans and reduces each heuristic to a score 0–10 per check, exposing concrete issues like binaries-in-repo, missing code review, and permission gaps. Data is available via a tokenless REST API, consumed by depths.dev, a CLI, and a GitHub Action that can post PR comments (work‑in‑progress). Public badges and BigQuery export exist; the API sees ~200,000 requests so far and example client code in Go is published.
AI-written summary · about
chapters (8)
- 0:00Introduction to trust and open source
- 7:25What is OpenSSF Scorecard
- 9:11Introducing the Scorecards API
- 13:07API use cases and demos
- 15:16Scorecards badges and workflows
- 17:26Getting started with Scorecard
- 18:29OpenSSF community and next steps
- 19:10Q&A session
related talks
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
19mAutomated Techniques for Measuring Trustworthiness of Open Source Code and Communities
37mOpenSSF Best Practices for Everyone!
20mBuilding Secure Software OpenSSF Best Practices for Everyone!