Structured Scorecard Results: Tailor Your Own Supply-Chain...
summary
OpenSSF Scorecard now exposes its underlying heuristics as Scorecard Structured Results so users can call individual probes (50+ heuristics) instead of relying on one aggregate score; probes like has_osv_vulnerabilities, archive and a fuzzing probe with about ten distinct findings return machine-readable JSON output including vulnerability IDs and file paths. Integrations show it running in CI, producing probe JSON that policy engines such as OPA or Kyverno can evaluate to pass or fail PRs.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:51OpenSSF Scorecard
- 9:22Scorecard output demo
- 12:58Scorecard checks limits
- 14:23Structured results introduction
- 19:37Probes vs checks
- 23:54Understanding findings
- 24:56Customizing policies
- 27:08Policy enforcement example
- 30:38Deployment and engine support
- 32:02Community feedback
- 33:40Conclusion
related talks
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
27mHow Do You Trust Your Open Source Software?
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
50mHow Do You Trust Open Source Software?
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
25mHow do you trust your open source software?
20mBuilding Secure Software OpenSSF Best Practices for Everyone!