Scorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
summary
OpenSSF Scorecard runs as a CLI, GitHub Action, API and weekly cron that already scans 1.2 million projects, and supports Allstar to open GitHub issues when score < threshold; Scorecard Monitor stores score deltas for trend analysis and the visualizer shows per-check reasons. A proof-of-concept wrapper runs Scorecard across all org repos via a GitHub App and a local-file visualizer proof-of-concept lets teams run privately; APIs, CSV-based discovery and local modes exist so you can automate, aggregate and act on real remediation tasks.
AI-written summary · about
chapters (7)
- 0:00Introduction to scorecard
- 3:47Basic usage and tools
- 6:35Running scorecard at scale
- 9:03Monitoring and APIs
- 14:22Advanced automation concepts
- 18:40Strategy and community input
- 27:44Questions and answers
related talks
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
25mHow do you trust your open source software?
27mHow Do You Trust Your Open Source Software?
36mEstimating Security Risk Through Repository Mining
40mOpenSSF Scorecards for Dart and Flutter projects
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
01h 01mAutomating dependency selection with open-source tools at scale
39mImplementing the OpenSSF Best Practices Badges & Scorecards Into Your Project