Reviewing NuGet Packages security easily using OpenSSF Scorecard
summary
About 80% of an app is third‑party code and Scorecard gives a fast, evidence‑based lens: OpenSSF Scorecard runs ~30 checks (vulns, branch protection, CI, signed releases), flags that Newtonsoft.Json: 2.9/3.2 score (poor), and shows common failures like missing branch protection and update bots. A small CLI pipeline (called fenic CLI) automates fetching scorecards for all NuGet transitive deps, highlights reproducibility and binary‑artifact risks, and pairs well with deps.dev and fuzzing/static analysis to prioritize reviews.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:13NuGet ecosystem risks
- 13:51OpenSSF Scorecard overview
- 26:49Scorecard checks deep dive
- 31:49Demo: Scorecard tool results
- 33:55Scorecard vs industry standards
- 38:51Improving Scorecard for .NET
- 47:42Conclusion & Q&A
related talks
57mReviewing NuGet Packages security easily using OpenSSF Scorecard
54mAssessing NuGet Packages more easily with Security Scorecards
48mAssessing 3rd Party Libraries More Easily With Security Scorecards
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?