OpenSSF Scorecards for Dart and Flutter projects
summary
Shows applying OpenSSF Scorecards to Dart and Flutter repos using Allstar as the foundation, then adding the scorecard GitHub Action, which opens ~133 security issues (128 closed) mainly from unpinned dependencies; fixes use Terraform and git xogs plus the Step Security tool and OSV scanner against pubspec.lock to pin deps, raising scores from mid‑6s to mid‑7s and into the low‑8s (green); also adds SBOMs and Salsa attestations to push scores further while acknowledging ongoing dependabot toil.
AI-written summary · about
chapters (16)
- 0:00OpenSSF Scorecards intro
- 2:35Talk agenda
- 5:47OpenSSF and Scorecards
- 9:01Allstar before Scorecards
- 12:18Scorecards on first repo
- 15:33Scaling Scorecards
- 17:1980% effort for 20%
- 18:04Perfect 10 impossible
- 20:17Static analysis for Dart
- 22:01Best Practices challenges
- 25:17Ongoing Scorecard toil
- 28:07Dependabot with GitHub Actions
- 30:38Bonus: SBOM and Salsa
- 35:24Supply chain trifecta
- 36:06Journey review
- 38:34Call to action
related talks
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
27mHow Do You Trust Your Open Source Software?
37mOpenSSF Best Practices for Everyone!
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
25mHow do you trust your open source software?
57mReviewing NuGet Packages security easily using OpenSSF Scorecard