In-Org Review Champions
Repos
OpenSSF Scorecard - Security health metrics for Open Source
Website and API for OpenSSF Scorecard
Official GitHub Action for OpenSSF Scorecard.
GitHub App to set and enforce security policies
Technical Advisory Council
A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Fuzz Introspector -- introspect, extend and optimise fuzzers
Helping allocate resources to secure the critical open source projects we all depend on.
OpenSSF Security Tooling Working Group
The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.
The purpose of the Metrics & Metadata (formerly Identifying Security Threats) working group is to enable stakeholders to have informed confidence in the security of open source projects. We do this by collecting, curating, and communicating relevant metrics and metadata from open source projects and the ecosystems of which they are a part.
The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.
Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)
The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
Gives criticality score for an open source project
Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the code they maintain, produce and use.
Collection of security best practices for package managers.
Working Group on Artificial Intelligence and Machine Learning (AI/ML) Security
Open Source Package Analysis