Open Source Security Foundation (OpenSSF)

All

77 repositories

malicious-packages
Public
A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Go
•
Apache License 2.0
•80•470•19•9•Updated Mar 18, 2026Mar 18, 2026
cve-bin-tool
Public
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl…
python security vulnerability
python security vulnerability vulnerabilities cve hacktoberfest cvss security-automation security-tools devsecops
Python
•
GNU General Public License v3.0
•602•1.6k•146•46•Updated Mar 18, 2026Mar 18, 2026
secure-sw-dev-fundamentals
Public
Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)
CSS
•
Creative Commons Attribution 4.0 International
•51•200•34•4•Updated Mar 18, 2026Mar 18, 2026
tac
Public
Technical Advisory Council
Other
•76•136•38•21•Updated Mar 18, 2026Mar 18, 2026
pvtr-github-repo-scanner
Public
Privateer plugin for scanning the security hygiene of a GitHub repository.
Go
•
Apache License 2.0
•12•21•22•4•Updated Mar 18, 2026Mar 18, 2026
osv-schema
Public
Open Source Vulnerability schema.
Go
•
Apache License 2.0
•113•240•50•7•Updated Mar 17, 2026Mar 17, 2026
glossary
Public
A reference for common terms when talking about OpenSSF and open source software security.
JavaScript
•
Apache License 2.0
•6•4•4•1•Updated Mar 17, 2026Mar 17, 2026
artwork
Public
OpenSSF Artwork
Apache License 2.0
•10•8•0•0•Updated Mar 17, 2026Mar 17, 2026
alpha-omega
Public
Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.
security opensource open-source-security
security opensource open-source-security
Open Policy Agent
•
Apache License 2.0
•62•116•0•0•Updated Mar 17, 2026Mar 17, 2026
toolbelt
Public
Apache License 2.0
•6•26•0•0•Updated Mar 17, 2026Mar 17, 2026
ossf-landscape
Public
Apache License 2.0
•28•31•0•1•Updated Mar 17, 2026Mar 17, 2026
wg-best-practices-os-developers
Public
The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.
JavaScript
•
Apache License 2.0
•187•998•81•12•Updated Mar 16, 2026Mar 16, 2026
fuzz-introspector
Public
Fuzz Introspector -- introspect, extend and optimise fuzzers
testing security fuzzing
testing security fuzzing fuzz-testing vulnerability-analysis security-research
Python
•
Apache License 2.0
•82•452•108•9•Updated Mar 16, 2026Mar 16, 2026
allstar
Public
GitHub App to set and enforce security policies
Go
•
Apache License 2.0
•144•1.4k•61•2•Updated Mar 16, 2026Mar 16, 2026
scorecard
Public
OpenSSF Scorecard - Security health metrics for Open Source
scorecard openssf-scorecard
scorecard openssf-scorecard
Go
•
Apache License 2.0
•612•5.3k•362•26•Updated Mar 16, 2026Mar 16, 2026
wg-globalcyberpolicy
Public
Global Cyber Policy Working Group
Apache License 2.0
•19•109•15•2•Updated Mar 11, 2026Mar 11, 2026
scorecard-webapp
Public
Website and API for OpenSSF Scorecard
openssf-scorecard
openssf-scorecard
Go
•
Apache License 2.0
•31•28•31•23•Updated Mar 9, 2026Mar 9, 2026
orbit-launchpad
Public
Apache License 2.0
•1•1•2•1•Updated Mar 8, 2026Mar 8, 2026
si-tooling
Public
Python
•
Apache License 2.0
•4•8•2•3•Updated Mar 2, 2026Mar 2, 2026
security-baseline
Public
Go
•
Apache License 2.0
•35•146•57•0•Updated Mar 2, 2026Mar 2, 2026
SIRT
Public
The OSS-SIRT SIG (Open Source Software Security Incident Response Team Special Interest Group) is a group working within the OSSF's Vulnerability Disclosure Wor…
Apache License 2.0
•6•10•2•1•Updated Mar 1, 2026Mar 1, 2026
sbom-everywhere
Public
Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption
Vue
•
Apache License 2.0
•41•112•23•13•Updated Feb 28, 2026Feb 28, 2026
scorecard-monitor
Public
Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts
security security-audit security-tools
security security-audit security-tools github-actions open-source-management openssf-scorecard
JavaScript
•
Apache License 2.0
•14•44•13•12•Updated Feb 28, 2026Feb 28, 2026
wg-orbit
Public
ORBIT: Open Resources for Baselines, Interoperability, and Tooling
Apache License 2.0
•4•21•7•1•Updated Feb 28, 2026Feb 28, 2026
package-analysis
Public
Open Source Package Analysis
Go
•
Apache License 2.0
•64•866•66•17•Updated Feb 27, 2026Feb 27, 2026
security-assessments
Public
Apache License 2.0
•7•18•7•2•Updated Feb 26, 2026Feb 26, 2026
security-insights
Public
Machine-readable specification for the attestation of security-relevant data.
Go
•
Other
•16•73•5•2•Updated Feb 24, 2026Feb 24, 2026
gpu-hashlib
Public
Apache License 2.0
•0•1•0•0•Updated Feb 13, 2026Feb 13, 2026
scorecard-action
Public
Official GitHub Action for OpenSSF Scorecard.
github security supply-chain
github security supply-chain github-actions openssf-scorecard
Go
•
Apache License 2.0
•82•366•28•13•Updated Feb 10, 2026Feb 10, 2026
wg-vulnerability-disclosures
Public
The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advoc…
Apache License 2.0
•43•214•44•0•Updated Feb 4, 2026Feb 4, 2026