Repositories list

• ossf-landscape

  Public
  Apache License 2.0

  •28•31•0•4•Updated Mar 22, 2026Mar 22, 2026

• cve-bin-tool

  Public

  ossf/cve-bin-tool’s past year of commit activity
  The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl…

  pythonsecurityvulnerability+ 11

  pythonsecurityvulnerabilityvulnerabilitiescvehacktoberfestcvsssecurity-automationsecurity-toolsdevsecops+ 4

  Python

  •

  GNU General Public License v3.0

  •606•1.6k•143•46•Updated Mar 22, 2026Mar 22, 2026

• malicious-packages

  Public

  ossf/malicious-packages’s past year of commit activity
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •80•471•21•10•Updated Mar 22, 2026Mar 22, 2026

• scorecard

  Public

  ossf/scorecard’s past year of commit activity
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •616•5.3k•362•32•Updated Mar 22, 2026Mar 22, 2026

• scorecard-webapp

  Public
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  openssf-scorecard

  Go

  •

  Apache License 2.0

  •31•28•31•24•Updated Mar 21, 2026Mar 21, 2026

• pvtr-github-repo-scanner

  Public

  ossf/pvtr-github-repo-scanner’s past year of commit activity
  Privateer plugin for scanning the security hygiene of a GitHub repository.

  Go

  •

  Apache License 2.0

  •12•21•22•5•Updated Mar 20, 2026Mar 20, 2026

• glossary

  Public
  A reference for common terms when talking about OpenSSF and open source software security.

  JavaScript

  •

  Apache License 2.0

  •6•4•4•3•Updated Mar 20, 2026Mar 20, 2026

• wg-best-practices-os-developers

  Public

  ossf/wg-best-practices-os-developers’s past year of commit activity
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •187•999•81•10•Updated Mar 20, 2026Mar 20, 2026

• wg-orbit

  Public

  ossf/wg-orbit’s past year of commit activity
  ORBIT: Open Resources for Baselines, Interoperability, and Tooling

  Apache License 2.0

  •4•21•7•1•Updated Mar 19, 2026Mar 19, 2026

• scorecard-monitor

  Public

  ossf/scorecard-monitor’s past year of commit activity
  Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

  securitysecurity-auditsecurity-tools+ 3

  securitysecurity-auditsecurity-toolsgithub-actionsopen-source-managementopenssf-scorecard

  JavaScript

  •

  Apache License 2.0

  •14•44•13•13•Updated Mar 19, 2026Mar 19, 2026

• security-insights

  Public
  Machine-readable specification for the attestation of security-relevant data.

  Go

  •

  Other

  •16•73•5•2•Updated Mar 19, 2026Mar 19, 2026

• security-baseline

  Public
  Go

  •

  Apache License 2.0

  •35•147•57•1•Updated Mar 19, 2026Mar 19, 2026

• osv-schema

  Public
  Open Source Vulnerability schema.

  Go

  •

  Apache License 2.0

  •114•242•50•9•Updated Mar 19, 2026Mar 19, 2026

• scorecard-action

  Public
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2

  githubsecuritysupply-chaingithub-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •82•366•28•12•Updated Mar 19, 2026Mar 19, 2026

• allstar

  Public
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •144•1.4k•61•3•Updated Mar 19, 2026Mar 19, 2026

• secure-sw-dev-fundamentals

  Public
  Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

  CSS

  •

  Creative Commons Attribution 4.0 International

  •51•200•34•4•Updated Mar 18, 2026Mar 18, 2026

• tac

  Public
  Technical Advisory Council

  Other

  •76•136•39•20•Updated Mar 18, 2026Mar 18, 2026

• artwork

  Public
  OpenSSF Artwork

  Apache License 2.0

  •10•8•0•0•Updated Mar 17, 2026Mar 17, 2026

• alpha-omega

  Public
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •62•118•0•0•Updated Mar 17, 2026Mar 17, 2026

• toolbelt

  Public
  Apache License 2.0

  •6•26•0•0•Updated Mar 17, 2026Mar 17, 2026

• fuzz-introspector

  Public
  Fuzz Introspector -- introspect, extend and optimise fuzzers

  testingsecurityfuzzing+ 3

  testingsecurityfuzzingfuzz-testingvulnerability-analysissecurity-research

  Python

  •

  Apache License 2.0

  •82•452•108•9•Updated Mar 16, 2026Mar 16, 2026

• wg-globalcyberpolicy

  Public
  Global Cyber Policy Working Group

  Apache License 2.0

  •19•109•15•2•Updated Mar 11, 2026Mar 11, 2026

• orbit-launchpad

  Public
  Apache License 2.0

  •1•1•2•1•Updated Mar 8, 2026Mar 8, 2026

• si-tooling

  Public
  Python

  •

  Apache License 2.0

  •4•8•2•3•Updated Mar 2, 2026Mar 2, 2026

• SIRT

  Public
  The OSS-SIRT SIG (Open Source Software Security Incident Response Team Special Interest Group) is a group working within the OSSF's Vulnerability Disclosure Wor…

  Apache License 2.0

  •6•10•2•1•Updated Mar 1, 2026Mar 1, 2026

• sbom-everywhere

  Public
  Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption

  Vue

  •

  Apache License 2.0

  •41•112•23•13•Updated Feb 28, 2026Feb 28, 2026

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •64•866•66•17•Updated Feb 27, 2026Feb 27, 2026

• security-assessments

  Public
  Apache License 2.0

  •7•18•7•2•Updated Feb 26, 2026Feb 26, 2026

• gpu-hashlib

  Public
  Apache License 2.0

  •0•1•0•0•Updated Feb 13, 2026Feb 13, 2026

• wg-vulnerability-disclosures

  Public
  The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advoc…

  Apache License 2.0

  •43•215•44•0•Updated Feb 4, 2026Feb 4, 2026