How Do You Trust Your Open Source Software?
summary
OpenSSF Scorecard programmatically scores open source projects by running ~70 checks (examples: binary artifacts, pinned deps, code review) and exposes results as JSON via a public REST API at api.securityscorecards.dev with no tokens required. A GitHub Action (1,000+ installs) and weekly scans of 1.2 million repositories feed a BigQuery dataset; the API sees ~85–100k requests/day. Sonatype finds score correlations to future vulnerabilities, badges populate READMEs, and the API is ready to plug into CI/CD for automated dependency policy enforcement.
AI-written summary · about
chapters (7)
- 0:00The supply chain challenge
- 2:43Introducing OpenSSF scorecard
- 5:27Adoption and impact
- 9:15Using the scorecard API
- 13:55Practical implementation
- 16:35Adding badges and community
- 18:57Q&A session
related talks
50mHow Do You Trust Open Source Software?
25mHow do you trust your open source software?
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
37mOpenSSF Best Practices for Everyone!
31mAssessing Open Source Software Projects in the Software Supply Chain
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...