OpenSSF Scorecard
Scores a repository's security practices 0 to 10 from about 18 automated checks.
github.com/ossf/scorecard ↗- Stars
- ★ 5,747
- License
- Apache-2.0
- Language
- Go
- Latest release
- v5.5.0 · 23 Apr 2026
- Last push
- 9 Oct 2026
- OpenSSF Scorecard
- 8.3 / 10
The standard way to judge a dependency's security hygiene; some checks are heuristics, so read the details, not just the score.
How it works
Scorecard reads a repository through the GitHub API and a clone and runs about 18 checks: branch protection, code review, dangerous workflow patterns, token permissions, pinned dependencies, signed releases, SAST, fuzzing, maintenance activity, known vulnerabilities (via OSV) and more. Each check scores 0 to 10 and the overall score is a risk-weighted average.
OpenSSF scans over a million popular repositories weekly and publishes the results through api.securityscorecards.dev and the scorecard.dev viewer, which is where this page's Scorecard column comes from. ossf/scorecard-action runs it on your own repository and uploads SARIF to code scanning.
What it catches
- Workflows with dangerous triggers or write-all tokens
- Unpinned actions and dependencies
- Missing branch protection or code review
- Unmaintained projects you depend on
Run it
brew install scorecard
GITHUB_AUTH_TOKEN=... scorecard --repo=github.com/ossf/scorecardWhat leaves your machine
Calls the GitHub API with your token and clones the repository. scorecard-action can publish your results to the public dataset.
Limits
- Some checks are heuristics, for example detecting SAST tools or fuzzing by name.
- A high score says the project protects itself well, not that its code is free of bugs.
Links
Related tools
GitHub stats as of 10 Oct 2026. How ratings work.