An Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
summary
OpenSSF Scorecard runs concrete automated checks — 20+ checks — against repositories via a GitHub Action, CLI and REST API, flagging checked-in binaries, missing branch protection, lax code review, exposed action secrets, stale dependencies and unsigned releases and offering exact remediation steps. Public telemetry covers an 1M+ projects dataset and integrations include Scorecard Monitor, All-Star and secure-repo. Demos show a repo scored, the failing checks listed, and the actionable fixes produced.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 1:48Open source's pervasive impact
- 3:56Software supply chain risks
- 5:40OpenSSF's role in security
- 9:14What is OpenSSF Scorecard
- 13:10Scorecard in action demo
- 17:08Prominent users and data sets
- 18:56Related tools and integrations
- 23:11Open source program office perspective
- 24:57How to get involved and next steps
- 26:23Q&A
related talks
27mHow Do You Trust Your Open Source Software?
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
50mHow Do You Trust Open Source Software?
25mHow do you trust your open source software?
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
37mOpenSSF Best Practices for Everyone!
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
42mDeveloping a Secure, Open Future