Assessing the Risk of Open-source Components Using OpenSSF's Scorecard
summary
OpenSSF Scorecard is an open-source scanner with a CLI and GitHub Action that runs ~1 million repositories weekly and publishes results to BigQuery; it implements about 18 checks (fuzzing, dependency pinning, branch protection, least-privilege CI) and powers deps.dev. Demos show a script-injection RCE via unescaped workflow variables and a real finding where 124 of 160 dependencies allowed force-push; outputs include JSON, detailed remediation links, and actionable alerts that integrate with org-scale enforcement.
AI-written summary · about
chapters (11)
- 0:00Introduction to scorecard
- 2:58Supply chain attack risks
- 6:05Scorecard overview
- 9:07Installing scorecard
- 11:53Interactive security quiz
- 16:28Using the scorecard CLI
- 22:48BigQuery data analysis
- 25:58Importance of pin dependencies
- 28:51Security demo conclusion
- 31:49Future goals and community
- 33:55Audience Q&A
related talks
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?
25mHow do you trust your open source software?
37mOpenSSF Best Practices for Everyone!
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
01h 01mAutomating dependency selection with open-source tools at scale
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...