Fortify Your Code: Secure Your Supply Chain with Scorecard
summary
Scorecard runs automated checks against a repo and returns a 0–10 numeric score based on tests like branch protection, binary artifacts, dependency hygiene and malicious packages, with results available via a web viewer, a CLI/docker image and a GitHub Action that posts into GitHub Code Scanning. Example runs show Kubernetes at 7.7, Docker CLI at 10/10, while a three‑year unmaintained repo surfaces multiple high‑risk findings. Scorecard also exposes APIs for CI integration and repeatable enforcement.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 1:23What is supply chain security
- 5:38Introducing Scorecard
- 8:28Scorecard access methods
- 9:32Web UI demo
- 10:36CLI demo
- 12:22GitHub Actions integration
- 14:28Q&A and closing
related talks
19mAutomated Techniques for Measuring Trustworthiness of Open Source Code and Communities
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
25mHow do you trust your open source software?
36mEstimating Security Risk Through Repository Mining
27mHow Do You Trust Your Open Source Software?
01h 01mAutomating dependency selection with open-source tools at scale
39mImplementing the OpenSSF Best Practices Badges & Scorecards Into Your Project
43mAdventures in Securing an Open Source Project: From Repo Security Zero...