Implementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
summary
OpenSSF Best Practices defines measurable criteria (passing/silver/gold) that require a security policy, vulnerability reporting, at least one automated test suite and one static analysis tool, and gold adds two unassociated contributors for continuity. Over 5,600+ projects participate and >1,000 are passing. Earning a badge is often a short form-fill but fixing gaps (automated tests, CI) takes longer; initial signup and review takes about 20 minutes to run. Automated scorecard GitHub Action and REST API run checks in ~10s and scan ~1.2M repos weekly.
AI-written summary · about
chapters (14)
- 0:00Welcome
- 1:47OpenSSF working groups
- 3:57OpenSSF Best Practices Badge
- 8:11Badge levels silver and gold
- 12:02Earning the Best Practices Badge
- 14:31Tips for passing the badge
- 17:24Static analysis requirements
- 20:14OpenSSF Scorecard introduction
- 22:03Scorecard evaluation method
- 26:02Scorecard for dependencies
- 27:49Integrating Scorecard
- 30:13Academic analysis of badges and Scorecard
- 32:37Badge vs Scorecard
- 35:27Q&A
related talks
39mImplementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
37mOpenSSF Best Practices for Everyone!
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
27mHow Do You Trust Your Open Source Software?
25mHow do you trust your open source software?
40mBuilding Developer Confidence in Software Security with the DevRel Community