Repositories list

• malicious-packages

  Public
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •119119 forks•564564 stars•2626 issues•2525 pull requests•Updated Jul 12, 2026Jul 12, 2026

• pvtr-github-repo-scanner

  Public
  Privateer plugin for scanning the security hygiene of a GitHub repository.

  Go

  •

  Apache License 2.0

  •1515 forks•2828 stars•3535 issues•33 pull requests•Updated Jul 11, 2026Jul 11, 2026

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •7373 forks•898898 stars•6565 issues•2020 pull requests•Updated Jul 10, 2026Jul 10, 2026

• wg-best-practices-os-developers

  Public
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •203203 forks•1k1k stars•8080 issues•99 pull requests•Updated Jul 10, 2026Jul 10, 2026

• scorecard-action

  Public
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2

  githubsecuritysupply-chaingithub-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •8787 forks•394394 stars•3333 issues•1010 pull requests•Updated Jul 10, 2026Jul 10, 2026

• scorecard

  Public
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •679679 forks•5.6k5.6k stars•376376 issues•5050 pull requests•Updated Jul 10, 2026Jul 10, 2026

• oss-crs

  Public
  Cyber Reasoning Systems for Bug-Finding and Patching in Open Source Software

  Python

  •

  MIT License

  •1717 forks•115115 stars•2626 issues•88 pull requests•Updated Jul 10, 2026Jul 10, 2026

• allstar

  Public
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •146146 forks•1.4k1.4k stars•5858 issues•77 pull requests•Updated Jul 10, 2026Jul 10, 2026

• scorecard-webapp

  Public
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  openssf-scorecard

  Go

  •

  Apache License 2.0

  •3030 forks•2929 stars•3333 issues•4040 pull requests•Updated Jul 10, 2026Jul 10, 2026

• ossf-landscape

  Public
  Apache License 2.0

  •2929 forks•3131 stars•00 issues•00 pull requests•Updated Jul 10, 2026Jul 10, 2026

• cve-bin-tool

  Public
  The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl…

  pythonsecurityvulnerability+ 11

  pythonsecurityvulnerabilityvulnerabilitiescvehacktoberfestcvsssecurity-automationsecurity-toolsdevsecops+ 4

  Python

  •

  GNU General Public License v3.0

  •636636 forks•1.7k1.7k stars•148148 issues•6060 pull requests•Updated Jul 10, 2026Jul 10, 2026

• fuzz-introspector

  Public
  Fuzz Introspector -- introspect, extend and optimise fuzzers

  testingsecurityfuzzing+ 3

  testingsecurityfuzzingfuzz-testingvulnerability-analysissecurity-research

  Python

  •

  Apache License 2.0

  •8686 forks•461461 stars•109109 issues•1717 pull requests•Updated Jul 10, 2026Jul 10, 2026

• security-baseline

  Public
  Go

  •

  Apache License 2.0

  •4242 forks•156156 stars•5353 issues•33 pull requests•Updated Jul 10, 2026Jul 10, 2026

• tac

  Public
  Technical Advisory Council

  Other

  •8282 forks•147147 stars•4545 issues•1717 pull requests•Updated Jul 9, 2026Jul 9, 2026

• best-practices-badge

  Public
  🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

  railsopen-sourcesecurity+ 7

  railsopen-sourcesecuritybest-practicesfosssupply-chainbadgeflossossfopenssf

  Ruby

  •

  MIT License

  •229229 forks•1.3k1.3k stars•211211 issues•1717 pull requests•Updated Jul 9, 2026Jul 9, 2026

• osv-schema

  Public
  Open Source Vulnerability schema.

  Go

  •

  Apache License 2.0

  •120120 forks•258258 stars•5252 issues•88 pull requests•Updated Jul 9, 2026Jul 9, 2026

• glossary

  Public
  A reference for common terms when talking about OpenSSF and open source software security.

  JavaScript

  •

  Apache License 2.0

  •88 forks•55 stars•44 issues•88 pull requests•Updated Jul 6, 2026Jul 6, 2026

• security-insights

  Public
  Machine-readable specification for the attestation of security-relevant data.

  Go

  •

  Other

  •1919 forks•7878 stars•88 issues•22 pull requests•Updated Jul 3, 2026Jul 3, 2026

• alpha-omega

  Public
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •6666 forks•137137 stars•00 issues•00 pull requests•Updated Jul 1, 2026Jul 1, 2026

• si-tooling

  Public
  Python

  •

  Apache License 2.0

  •44 forks•99 stars•22 issues•00 pull requests•Updated Jul 1, 2026Jul 1, 2026

• SIRT

  Public
  The OSS-SIRT SIG (Open Source Software Security Incident Response Team) is a group working within the OSSF's Vulnerability Disclosure Working Group that is focu…

  Apache License 2.0

  •66 forks•1010 stars•00 issues•22 pull requests•Updated Jun 28, 2026Jun 28, 2026

• education

  Public
  OpenSSF Education SIG

  Apache License 2.0

  •1717 forks•1919 stars•44 issues•33 pull requests•Updated Jun 28, 2026Jun 28, 2026

• community

  Public
  SCSS

  •

  Creative Commons Attribution 4.0 International

  •77 forks•99 stars•00 issues•33 pull requests•Updated Jun 26, 2026Jun 26, 2026

• scorecard-monitor

  Public
  Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

  securitysecurity-auditsecurity-tools+ 3

  securitysecurity-auditsecurity-toolsgithub-actionsopen-source-managementopenssf-scorecard

  JavaScript

  •

  Apache License 2.0

  •1616 forks•4848 stars•1414 issues•88 pull requests•Updated Jun 23, 2026Jun 23, 2026

• scorecard-visualizer

  Public
  Tool for visualizing the Open SSF Scorecard Api data in a human friendly way

  openssfopenssf-scorecard

  openssfopenssf-scorecard

  TypeScript

  •

  Apache License 2.0

  •88 forks•1919 stars•11 issue•2020 pull requests•Updated Jun 22, 2026Jun 22, 2026

• wg-globalcyberpolicy

  Public
  Global Cyber Policy Working Group

  Apache License 2.0

  •2121 forks•120120 stars•1717 issues•11 pull request•Updated Jun 17, 2026Jun 17, 2026

• project-template

  Public template
  OpenSSF Project Template

  Apache License 2.0

  •1111 forks•2323 stars•11 issue•22 pull requests•Updated Jun 5, 2026Jun 5, 2026

• package-feeds

  Public
  Feed parsing for language package manager updates

  Go

  •

  Apache License 2.0

  •1919 forks•8787 stars•2121 issues•1212 pull requests•Updated Jun 1, 2026Jun 1, 2026

• gpu-hashlib

  Public
  Rust

  •

  Apache License 2.0

  •11 fork•44 stars•00 issues•11 pull request•Updated May 29, 2026May 29, 2026

• security-assessments

  Public
  Apache License 2.0

  •77 forks•2020 stars•55 issues•00 pull requests•Updated May 28, 2026May 28, 2026