ossf/scorecard

View on GitHub

OpenSSF Scorecard - Security health metrics for Open Source

Stars: 5.7k
Forks: 724
Open beginner issues: 3
Indexed issues: 388
Avg merge: 19h 30m
Merged PRs (30d): 1

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 8, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue help wanted

Beginner friendly Everything

Open All

388 open issues indexed

Do you consider Mutation testing alongside Coverage and Fuzzing? Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/scorecard#5242 · Opened Sep 16, 2026
BUG: Vulnerabilities check no longer disables Python transitive resolution after the osv-scanner v2.3.2 bump Open

Difficulty 3/5 1-2 days Newbie friendliness 76/100

ossf/scorecard#5234 · Opened Sep 11, 2026
Feature - Pinned-Dependencies support self-repository GitHub actions syntax Open

kind/enhancement

Difficulty 3/5 1-2 days Newbie friendliness 72/100

ossf/scorecard#5232 · 1 comment · 3 reactions · Opened Sep 10, 2026
Serialization error when rendering results attestation Open

kind/bug

Difficulty 3/5 1-2 days Newbie friendliness 66/100

ossf/scorecard#5224 · Opened Sep 8, 2026
BUG: unconditional ListCommits makes Scorecard unusable with a GitHub App installation token Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ossf/scorecard#5214 · 1 comment · Opened Sep 3, 2026
[IMPORTANT] Scorecard Infrastructure Changes Open

ossf/scorecard#5208 · 9 comments · 9 reactions · 4 assignees · Opened Aug 30, 2026
PinnedDependenciesID should recognize GitHub actions.lock enforcement Open

needs triage

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/scorecard#5207 · 2 comments · Opened Aug 29, 2026
BUG: Code-Review treats any merged PR with an approved/lgtm label as reviewed, ignoring the PR's actual reviews Open

needs triage

Difficulty 4/5 3-5 days Newbie friendliness 68/100

ossf/scorecard#5206 · 2 comments · Opened Aug 29, 2026
Packaging check does not recognize GitHub CLI and Nextcloud App Store publishing workflows Open

needs triage

Difficulty 3/5 1-2 days Newbie friendliness 65/100

ossf/scorecard#5201 · Opened Aug 27, 2026
BUG: Security-Policy scores the contents of an unrelated security.md found elsewhere in the tree Open

needs triage

Difficulty 3/5 1-2 days Newbie friendliness 78/100

ossf/scorecard#5198 · 1 comment · Opened Aug 25, 2026
Go fuzz build fails with GOMODCACHE overlay Open

kind/bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

ossf/scorecard#5193 · 1 comment · 1 reaction · Opened Aug 23, 2026
Packaging check should recognize gh release create workflows Open

needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ossf/scorecard#5188 · 1 comment · Opened Aug 18, 2026
BUG: Token-Permissions ignores packages: write for non-GitHub publishing workflows Open

kind/bug needs triage

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ossf/scorecard#5170 · 2 comments · Opened Aug 10, 2026
Feature: Packaging check should detect winget publishing workflows Open

needs triage

Difficulty 3/5 1-2 days Newbie friendliness 78/100

ossf/scorecard#5168 · 1 comment · Opened Aug 9, 2026
Feature --local needs --exclude or similar mechanism to allow excluding directories from the analysis Open

kind/enhancement needs triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ossf/scorecard#5162 · Opened Aug 4, 2026
BUG: CI-Tests misses successful CI when checkSuites exceed the first 30 Open

needs triage

Difficulty 3/5 1-2 days Newbie friendliness 78/100

ossf/scorecard#5149 · 1 comment · Opened Jul 30, 2026
Feature: Packaging check should detect cargo-dist (axodotdev) Rust release workflows Open

needs triage

Difficulty 4/5 3-5 days Newbie friendliness 68/100

ossf/scorecard#5145 · Opened Jul 27, 2026
BUG: Packaging check's ko matcher requires BOTH setup-ko spellings in one job, so ko publishing is never detected Open

needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/scorecard#5133 · 2 comments · Opened Jul 17, 2026
Feature: Packaging check should detect step-security/goreleaser-action (maintained fork of goreleaser/goreleaser-action) Open

needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ossf/scorecard#5131 · 1 comment · Opened Jul 17, 2026
Feature: Add winget package manager support Open

kind/enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

ossf/scorecard#5100 · Opened Jun 21, 2026
Feature: Support changesets for the Packaging check Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

ossf/scorecard#5096 · 1 comment · Opened Jun 16, 2026
GitHub Actions dependencies reported as "unknown license" despite having valid MIT licenses Open

needs triage

Difficulty 3/5 1-2 days Newbie friendliness 64/100

ossf/scorecard#5090 · 1 comment · Opened Jun 7, 2026
BUG: --local mode returns N/A for workflow/policy checks on Windows due to path separator handling Open

kind/bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ossf/scorecard#5088 · 1 comment · Opened Jun 5, 2026
BUG: CII-Best-Practices scores 0 on sibling repos of a single-badge multi-repo project Open

kind/bug needs triage

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/scorecard#5078 · Opened May 29, 2026
BUG: YAML parsing error Open

kind/bug needs triage

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ossf/scorecard#5072 · Opened May 27, 2026
Dependency-Update-Tool false negative when config file is marked export-ignore in .gitattributes Open

needs triage Stale

Difficulty 4/5 3-5 days Newbie friendliness 52/100

ossf/scorecard#5069 · 1 comment · Opened May 22, 2026
Allow `LICENSE` File to be located in `/.github` Directory Open

kind/enhancement needs triage Stale

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ossf/scorecard#5068 · 1 comment · Opened May 20, 2026
scorecard Pinned-Dependencies: uv.lock is not good enough? Open

Stale

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/scorecard#5057 · 1 comment · Opened May 13, 2026
BUG - Scorecard version v5.5.0 doesn't work anymore with GitLab projects Open

kind/bug

Difficulty 3/5 1-2 days Newbie friendliness 64/100

ossf/scorecard#5056 · 2 comments · 1 reaction · Opened May 12, 2026
Recognize Homebrew Core formulae as packages Open

kind/enhancement needs triage Stale

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ossf/scorecard#5042 · 1 comment · Opened May 1, 2026
BUG: tarball extraction fails with "file exists" error when archive contains duplicate directory entries Open

kind/bug

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

ossf/scorecard#5023 · 3 comments · Opened Apr 17, 2026
ACMM: AI Codebase Maturity Model — similar to OpenSSF badges but for AI-assisted engineering Open

needs triage Stale

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/scorecard#5021 · 1 comment · Opened Apr 16, 2026
BUG Wrong completion generation for installed binary on linux Open

kind/bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ossf/scorecard#5019 · 1 comment · Opened Apr 15, 2026
Best Practices Badge integration with Scorecard v6 Open

Stale

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ossf/scorecard#4990 · 1 comment · Opened Mar 30, 2026
BUG Docs refer to legacy docker image naming or else docker image naming broken Open

kind/bug needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 52/100

ossf/scorecard#4951 · 4 comments · 2 reactions · Opened Feb 26, 2026
Provide folders and files information for vulnerabilities Open

kind/enhancement needs triage Stale

Difficulty 4/5 3-5 days Newbie friendliness 42/100

ossf/scorecard#4938 · 2 comments · Opened Feb 12, 2026
Request: Add github.com/systemslibrarian/meow-decoder to automated scans Open

needs triage Stale

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ossf/scorecard#4930 · 1 comment · Opened Feb 6, 2026
SARIF format is not supported yet Open

kind/enhancement needs triage Stale

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ossf/scorecard#4900 · 2 comments · Opened Jan 5, 2026
Add support for props keyword Open

kind/enhancement needs triage Stale

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ossf/scorecard#4886 · 5 comments · Opened Dec 17, 2025
About osv-scanner version upgrade Open

needs triage Stale

Difficulty 3/5 1-2 days Newbie friendliness 30/100

ossf/scorecard#4859 · 2 comments · Opened Nov 24, 2025
Option to skip or ignore files and folder while scanning for Vulnerabilities Open

kind/enhancement needs triage Stale

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/scorecard#4841 · 6 comments · Opened Nov 6, 2025
Feature: allow links for license files Open

kind/enhancement needs triage Stale

Difficulty 3/5 1-2 days Newbie friendliness 55/100

ossf/scorecard#4828 · 3 comments · 1 reaction · Opened Oct 21, 2025
Feature: New Check: Check if the project has and maintains a CHANGELOG Open

kind/enhancement Stale

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/scorecard#4824 · 3 comments · Opened Oct 17, 2025
Feature: pass Signed-Releases with GitHub immutable release process Open

kind/enhancement needs triage

Difficulty 4/5 3-5 days Newbie friendliness 55/100

ossf/scorecard#4823 · 7 comments · 4 reactions · Opened Oct 14, 2025
Reflect experimental checks in `checks.yaml` Open

kind/enhancement Stale

ossf/scorecard#4799 · 3 comments · 1 assignee · Opened Sep 22, 2025
Rethinking vulnerability check scoring logic: distinguishing between "no vulnerabilities" and "no disclosure" Open

Stale

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/scorecard#4789 · 1 comment · Opened Sep 15, 2025
Propose Three New Checks - Seeking Confirmation, Thanks！ Open

kind/enhancement Stale

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/scorecard#4769 · 1 comment · Opened Aug 26, 2025
Token-Permissions returns false positive Open

kind/bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ossf/scorecard#4762 · 1 comment · Opened Aug 24, 2025
Error: check runtime error: CI-Tests: internal error: internal error: Client.Repositories.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: non-200 OK status code: 502 Bad Gateway body for GitHub repo Open

kind/bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/scorecard#4760 · 1 comment · 1 reaction · Opened Aug 20, 2025
Should subprocess.check_call(list) be safe in the check of Dangerous-workflow? Open

Stale

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/scorecard#4748 · 1 comment · Opened Aug 7, 2025

ossf/scorecard

Get new issues in your inbox