OpenSSF Scorecard

Visit Website

Introduction

OpenSSF Scorecard assesses open-source projects against a set of security health checks and gives each a score from 0 to 10. It helps maintainers improve their own projects and helps consumers judge the risk of dependencies.

Checks include branch protection, code review, CI tests, fuzzing, SAST, pinned dependencies, token permissions, dangerous workflow patterns, signed releases, maintained status, vulnerabilities and more. It runs as a CLI, as a GitHub Action that uploads results to code scanning, and through a public API with weekly scans of many popular projects.

In the quality loop Scorecard checks the health of the delivery process itself.

The source code is at ossf/scorecard on GitHub under the Apache-2.0 licence, with about 5,800 stars; the most recent commit was on 10 November 2026.

Features

1. Security checks: Around twenty automated checks.
2. Scores: 0 to 10 per check and overall.
3. GitHub Action: Results in code scanning.
4. Public data: Weekly scans and an API.
5. Remediation guidance: Each check explains how to improve.
6. Dependency assessment: Score projects you depend on.

Pros

1. Free and public: No account needed for public data.
2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 10 November 2026.
4. Community: About 5,800 GitHub stars.

Cons

1. Heuristic: Scores are signals, not guarantees.
2. GitHub-centric: Best support for GitHub-hosted projects.
3. Gaming risk: Teams can optimise for the score rather than security.

Usage and Links (Example)

scorecard --repo=github.com/ossf/scorecard --format=json

Or add the ossf/scorecard-action workflow to publish results.

Resources:

• OpenSSF Scorecard website
• GitHub repository

Pricing

OpenSSF Scorecard is free and open source under the Apache-2.0 licence.

Recommended for?

1. Open-source maintainers improving project hygiene.
2. Security teams vetting dependencies.

Conclusion

Scorecard is a free, practical health check for repository security practices.

Use it to find gaps, then fix the practices rather than chasing the number.

On CheckOps, OpenSSF Scorecard is filed under the Release & CI gates and Security testing stages. Related tools listed here include cdxgen, Cosign, Syft, Grype, OWASP Dependency-Track and Trivy. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.