OpenSSF Scorecard

What it is

An automated tool from the Open Source Security Foundation that runs a set of checks against a code repository and gives each one a score from 0 to 10. Checks cover branch protection, code review, pinned dependencies, dangerous workflows, signed releases, and more.

What it helps with

- Judging the risk of a dependency before adopting it
- Finding weak spots in your own project's security practices
- Tracking repository hygiene across many projects
- Running checks on every push with a GitHub Action

Who it's for

Open source maintainers, developers choosing dependencies, and security teams reviewing third-party code.

Worth knowing

Results for many popular projects are published weekly, so you can look up a score without running anything. Scanning a GitHub repository yourself needs an access token to stay within API limits.

Does a high score mean a project has no vulnerabilities?
No, it measures security practices, not the presence of known flaws in the code.

What should I use alongside it?
In our view OSV-Scanner and Dependency-Track cover the other side, finding known vulnerabilities in the dependencies you already use.