OpenSSF Scorecard - Security Scorecards for FOSS Projects

Open source software powers modern applications, but not all projects follow the same security practices.

As developers and organizations depend more on external libraries, it becomes important to understand the security posture of those dependencies before using them in production.

This session introduces OpenSSF Scorecard, an open source tool that automatically evaluates projects against a set of security best practices.

It generates a practical “security score” by checking factors like code reviews, branch protection, dependency updates, and release processes.

With a simple demo, participants will see how Scorecard can be run on any GitHub repository, how to interpret the results, and how both maintainers and consumers can use these insights to improve security and make better dependency decisions.

What OpenSSF Scorecard is and why it matters

How security scores are generated through automated checks

Using Scorecard to evaluate dependency risk

Improving project security as a maintainer

Making safer open source adoption decisions