Skip to content

@ossf Open Source Security Foundation (OpenSSF)

Change the repository type filter

All

    Repositories list

    74 repositories

    • scorecard

      Public
      OpenSSF Scorecard - Security health metrics for Open Source
      scorecardopenssf-scorecard
      Go
      •
      Apache License 2.0
      •586•5.2k•361•9•Updated Nov 25, 2025Nov 25, 2025

    • security-baseline

      Public
      Go
      •
      Apache License 2.0
      •33•118•52•8•Updated Nov 25, 2025Nov 25, 2025

    • malicious-packages

      Public
      A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
      Go
      •
      Apache License 2.0
      •65•410•11•8•Updated Nov 25, 2025Nov 25, 2025

    • osv-schema

      Public
      Open Source Vulnerability schema.
      Go
      •
      Apache License 2.0
      •108•215•34•13•Updated Nov 25, 2025Nov 25, 2025

    • ossf-landscape

      Public
      Apache License 2.0
      •27•30•0•2•Updated Nov 24, 2025Nov 24, 2025

    • scorecard-action

      Public
      Official GitHub Action for OpenSSF Scorecard.
      githubsecuritysupply-chaingithub-actionsopenssf-scorecard
      Go
      •
      Apache License 2.0
      •79•339•27•4•Updated Nov 24, 2025Nov 24, 2025

    • scorecard-webapp

      Public
      Website and API for OpenSSF Scorecard
      openssf-scorecard
      Go
      •
      Apache License 2.0
      •31•28•31•15•Updated Nov 24, 2025Nov 24, 2025

    • fuzz-introspector

      Public
      Fuzz Introspector -- introspect, extend and optimise fuzzers
      testingsecurityfuzzingfuzz-testingvulnerability-analysissecurity-research
      Python
      •
      Apache License 2.0
      •77•434•103•2•Updated Nov 24, 2025Nov 24, 2025

    • allstar

      Public
      GitHub App to set and enforce security policies
      Go
      •
      Apache License 2.0
      •144•1.4k•59•3•Updated Nov 24, 2025Nov 24, 2025

    • gemara

      Public
      Minimizing rework for governance activities.
      Go
      •
      Apache License 2.0
      •16•30•28•6•Updated Nov 24, 2025Nov 24, 2025

    • SIRT

      Public
      The OSS-SIRT SIG (Open Source Software Security Incident Response Team Special Interest Group) is a group working within the OSSF's Vulnerability Disclosure Working Group that is focused on creating secure vulnerability management capabilities within the open source ecosystem to ensure effective coordinated vulnerability disclosure practices (CVD)
      Apache License 2.0
      •6•10•2•0•Updated Nov 20, 2025Nov 20, 2025

    • wg-globalcyberpolicy

      Public
      Global Cyber Policy Working Group
      Apache License 2.0
      •17•94•10•2•Updated Nov 20, 2025Nov 20, 2025

    • glossary

      Public
      A reference for common terms when talking about OpenSSF and open source software security.
      JavaScript
      •
      Apache License 2.0
      •4•5•2•9•Updated Nov 19, 2025Nov 19, 2025

    • wg-best-practices-os-developers

      Public
      The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.
      JavaScript
      •
      Apache License 2.0
      •184•951•67•9•Updated Nov 19, 2025Nov 19, 2025

    • scorecard-monitor

      Public
      Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts
      securitysecurity-auditsecurity-toolsgithub-actionsopen-source-managementopenssf-scorecard
      JavaScript
      •
      Apache License 2.0
      •14•39•13•8•Updated Nov 18, 2025Nov 18, 2025

    • scorecard-visualizer

      Public
      Tool for visualizing the Open SSF Scorecard Api data in a human friendly way
      openssfopenssf-scorecard
      TypeScript
      •
      Apache License 2.0
      •6•18•1•11•Updated Nov 18, 2025Nov 18, 2025

    • tac

      Public
      Technical Advisory Council
      Other
      •72•133•39•7•Updated Nov 17, 2025Nov 17, 2025

    • sbom-everywhere

      Public
      Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption
      Vue
      •
      Apache License 2.0
      •38•111•22•6•Updated Nov 15, 2025Nov 15, 2025

    • education

      Public
      OpenSSF Education SIG
      Apache License 2.0
      •16•18•4•2•Updated Nov 15, 2025Nov 15, 2025

    • oss-vulnerability-guide

      Public
      A guide on coordinated vulnerability disclosure for open source projects. Includes templates for security policies (security.md) and disclosure notifications.
      Creative Commons Attribution 4.0 International
      •42•130•5•1•Updated Nov 15, 2025Nov 15, 2025

    • wg-securing-software-repos

      Public
      OpenSSF Working Group on Securing Software Repositories
      Other
      •25•123•11•4•Updated Nov 13, 2025Nov 13, 2025

    • alpha-omega

      Public
      Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.
      securityopensourceopen-source-security
      Open Policy Agent
      •
      Apache License 2.0
      •61•110•0•4•Updated Nov 3, 2025Nov 3, 2025

    • ai-ml-security

      Public
      Working Group on Artificial Intelligence and Machine Learning (AI/ML) Security
      Apache License 2.0
      •20•124•8•1•Updated Oct 17, 2025Oct 17, 2025

    • wg-vulnerability-disclosures

      Public
      The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.
      Apache License 2.0
      •43•204•34•0•Updated Oct 1, 2025Oct 1, 2025

    • wg-orbit

      Public
      ORBIT: Open Resources for Baselines, Interoperability, and Tooling
      Apache License 2.0
      •4•20•10•0•Updated Sep 29, 2025Sep 29, 2025

    • artwork

      Public
      OpenSSF Artwork
      Apache License 2.0
      •10•9•0•0•Updated Sep 18, 2025Sep 18, 2025

    • security-insights

      Public
      Machine-readable specification for the attestation of security-relevant data.
      CUE
      •
      Other
      •15•64•10•1•Updated Sep 16, 2025Sep 16, 2025

    • foundation

      Public
      OpenSSF Governance and Legal Docs
      Apache License 2.0
      •17•73•0•0•Updated Sep 9, 2025Sep 9, 2025

    • security-assessments

      Public
      Apache License 2.0
      •4•16•6•2•Updated Aug 28, 2025Aug 28, 2025

    • .github

      Public
      Github configuration
      6•2•0•2•Updated Aug 14, 2025Aug 14, 2025