Implementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 14:30· Room 0E-2 (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Scorecard automatically rates repos on a scorecard 0–10 scale across ~18 automated checks (branch protection, pinned deps, signed releases, CI/fuzzing, security policy) and runs weekly against ~1M projects with a REST API and GitHub/GitLab support plus a GitHub Action for CI. The Best Practices Badge documents 67+ human-and-automated criteria with three levels (best practices badge (passing/silver/gold)), 6,000 projects enrolled and >1,000 passing; common fixes are add tests, security.md, 2FA, and signed releases.
AI-written summary · about
chapters (6)
- 0:00OpenSSF Best Practices intro
- 2:29Security Scorecard overview
- 7:03Best Practices Badge intro
- 13:05Scorecard vs Badge
- 27:50Roadmap and future
- 30:26Q&A on criteria
related talks
53mImplementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
25mHow do you trust your open source software?
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
37mOpenSSF Best Practices for Everyone!
27mHow Do You Trust Your Open Source Software?
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...