Owner

ossf

27 indexed repositories · View on GitHub

scorecard
OpenSSF Scorecard - Security health metrics for Open Source

Go · 5697 stars
cve-bin-tool
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnera...

Python · 1765 stars
criticality_score
Gives criticality score for an open source project

Go · 1457 stars
allstar
GitHub App to set and enforce security policies

Go · 1453 stars
best-practices-badge
🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

Ruby · 1360 stars
wg-best-practices-os-developers
The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for ope...

JavaScript · 1067 stars
package-analysis
Open Source Package Analysis

Go · 912 stars
malicious-packages
A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerabilit...

Go · 610 stars
scorecard-action
Official GitHub Action for OpenSSF Scorecard.

Go · 418 stars
osv-schema
Open Source Vulnerability schema.

Go · 271 stars
wg-supply-chain-integrity
Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the ...

208 stars
secure-sw-dev-fundamentals
Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

CSS · 206 stars
security-baseline

Go · 166 stars
oss-crs
Cyber Reasoning Systems for Bug-Finding and Patching in Open Source Software

Python · 158 stars
tac
Technical Advisory Council

152 stars
wg-globalcyberpolicy
Global Cyber Policy Working Group

126 stars
security-insights
Machine-readable specification for the attestation of security-relevant data.

Go · 80 stars
scorecard-webapp
Website and API for OpenSSF Scorecard

HTML · 33 stars
pvtr-github-repo-scanner
Privateer plugin for scanning the security hygiene of a GitHub repository.

Go · 31 stars
wg-orbit
ORBIT: Open Resources for Baselines, Interoperability, and Tooling

30 stars
7 more repositories live on View on GitHub

Beginner friendly Everything

Open All

in-scope and out-of-scope generate as *URL, so any file that uses them fails to load Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

ossf/si-tooling#68 · Opened Sep 15, 2026
Bug: "All Levels" criteria page - Baseline unconditionally renders `{N/A justification} {Met URL}` Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

ossf/best-practices-badge#3017 · Opened Sep 14, 2026
validatePURL fails for VSCode ecosystem due to missing entry in purlEcosystems and incorrect namespace separator Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

ossf/malicious-packages#1512 · 1 comment · Opened Sep 10, 2026
Meeting registration link is wrong Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

ossf/wg-globalcyberpolicy#111 · Opened Sep 8, 2026
Uncaught `CalledProcessError` from `strings` on macOS: BSD `strings` exits 1 on Java class files (0xCAFEBABE misparsed as Mach-O fat binary), crashing the whole scan Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ossf/cve-bin-tool#5907 · Opened Sep 8, 2026
Clarify voluntary vs mandatory reporting in OSS Steward Obligations Checklist Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ossf/wg-globalcyberpolicy#110 · Opened Sep 2, 2026
docs/dns.md is stale: describes GCP DNS/Cloud Run, not the AWS setup Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ossf/scorecard-infra#75 · Opened Aug 30, 2026
pyscg: Cover / include the OpenSSF Contribution guide for AI Open

Product: Python Hardening Guide

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/wg-best-practices-os-developers#1131 · Opened Aug 26, 2026
Create `CONFORMANCE_READ_TOKEN` variable to obtain latest conformance runs Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/model-signing-spec#14 · Opened Aug 26, 2026
Enable GitHub Pages to publish OMS Conformance Report Open

Difficulty 1/5 Under an hour Newbie friendliness 85/100

ossf/model-signing-spec#13 · Opened Aug 26, 2026
docs: propose a macOS / Apple Silicon setup FAQ Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

ossf/oss-crs#369 · 2 comments · 1 reaction · Opened Aug 24, 2026
New IoCs for MAL-2026-13631: same jsonbin C2 bin (6a718a58da38895dfeb6e2ed) delivered via fake freelance repo Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ossf/malicious-packages#1457 · 2 comments · Opened Aug 19, 2026
Packaging check should recognize gh release create workflows Open

needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ossf/scorecard#5188 · 1 comment · Opened Aug 18, 2026
Typo in CVE Binary Tool Documentation link on Wiki Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

ossf/cve-bin-tool#5881 · Opened Aug 16, 2026
Provide ARM64 docker image Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ossf/scorecard-action#1697 · 1 reaction · Opened Aug 14, 2026
GCC should use -Wimplicit-fallthrough=5 Open

Product: Compiler Annotations Guide Product: Compiler Hardening Guide

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ossf/wg-best-practices-os-developers#1116 · 11 comments · Opened Jul 20, 2026
BUG: Packaging check's ko matcher requires BOTH setup-ko spellings in one job, so ko publishing is never detected Open

needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/scorecard#5133 · 2 comments · Opened Jul 17, 2026
Feature: Packaging check should detect step-security/goreleaser-action (maintained fork of goreleaser/goreleaser-action) Open

needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

ossf/scorecard#5131 · 1 comment · Opened Jul 17, 2026
`action.yaml` references the runtime image by mutable tag, SHA-pinning the action does not pin the executed code Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/scorecard-action#1676 · 1 comment · Opened Jul 3, 2026
Refresh OSPS Baseline 2026-02 catalog data Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/pvtr-github-repo-scanner#344 · Opened Jun 10, 2026
Title and Meta description need fixing on the website Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

ossf/best-practices-badge#2832 · Opened Jun 7, 2026
Put a GitHub icon with a link to the repo on your website Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

ossf/best-practices-badge#2831 · 4 comments · Opened Jun 7, 2026
Wrong link to iapp.org Open

Difficulty 1/5 Under an hour Newbie friendliness 85/100

ossf/secure-sw-dev-fundamentals#204 · Opened Jun 7, 2026
Allow `LICENSE` File to be located in `/.github` Directory Open

kind/enhancement needs triage Stale

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ossf/scorecard#5068 · 1 comment · Opened May 20, 2026
BUG: tarball extraction fails with "file exists" error when archive contains duplicate directory entries Open

kind/bug

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

ossf/scorecard#5023 · 3 comments · Opened Apr 17, 2026
Allow merge_group events when publish_results is false Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

ossf/scorecard-action#1647 · Opened Apr 3, 2026
Update issue template Open

Difficulty 1/5 Under an hour Newbie friendliness 65/100

ossf/glossary#87 · Opened Mar 17, 2026
Upstream Collab Guide: Add a brief section about avoiding AI Slop Open

Product: Upstream Collaboration Guide

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

ossf/wg-best-practices-os-developers#1055 · 1 comment · Opened Mar 4, 2026
pyscg: Reduce 0003 content to be more concise Open

Product: Python Hardening Guide

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

ossf/wg-best-practices-os-developers#1027 · 3 comments · Opened Jan 26, 2026
OpenSSF Documentation Updates Open

Difficulty 1/5 Under an hour Newbie friendliness 62/100

ossf/malicious-packages#1109 · Opened Dec 12, 2025
Add EN 50767 to https://policy.openssf.org/CRA/standards.html Open

Candidate to Close

Difficulty 1/5 Under an hour Newbie friendliness 72/100

ossf/wg-globalcyberpolicy#73 · Opened Aug 21, 2025
Codespaces instructions in CONTRIBUTING.md Open

Stale

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

ossf/scorecard#4715 · 8 comments · Opened Jul 22, 2025
Signed Releases documentation unhelpful Open

Stale

Difficulty 1/5 1-3 hours Newbie friendliness 72/100

ossf/scorecard#4713 · 7 comments · Opened Jul 22, 2025
docs: add code coverage documentation to test README Open

documentation

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ossf/cve-bin-tool#4952 · 3 comments · Opened Mar 17, 2025
README/FAQ: Unclear references to "the webviewer" Open

kind/docs Stale

Difficulty 1/5 1-3 hours Newbie friendliness 78/100

ossf/scorecard#3986 · 10 comments · Opened Apr 2, 2024
some references to best practices.coreinfrastructure.org still in best-practices-badge-intro.ppt Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/best-practices-badge#2081 · Opened Nov 30, 2023
Viewer should sort checks alphabetically within threat categories Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ossf/scorecard-webapp#430 · 1 comment · Opened Jun 26, 2023
"cve_bin_tool.log.LOGGER is not a valid type" Open

good first issue

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

ossf/cve-bin-tool#2870 · 7 comments · Opened Mar 29, 2023

ossf

Get new issues in your inbox