Repositories list

• osv-schema

  Public
  Open Source Vulnerability schema.

  Go

  •

  Apache License 2.0

  •125125 forks•269269 stars•5151 issues•99 pull requests•Updated Sep 2, 2026Sep 2, 2026

• ossf-landscape

  Public
  Apache License 2.0

  •2929 forks•3333 stars•00 issues•00 pull requests•Updated Sep 1, 2026Sep 1, 2026

• malicious-packages

  Public
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •137137 forks•606606 stars•3232 issues•1717 pull requests•Updated Sep 1, 2026Sep 1, 2026

• pvtr-github-repo-scanner

  Public
  Privateer plugin for scanning the security hygiene of a GitHub repository.

  Go

  •

  Apache License 2.0

  •1818 forks•3131 stars•1717 issues•55 pull requests•Updated Sep 1, 2026Sep 1, 2026

• scorecard-webapp

  Public
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  openssf-scorecard

  Go

  •

  Apache License 2.0

  •3333 forks•3131 stars•3535 issues•1717 pull requests•Updated Sep 1, 2026Sep 1, 2026

• oss-crs

  Public
  Cyber Reasoning Systems for Bug-Finding and Patching in Open Source Software

  Python

  •

  MIT License

  •3030 forks•149149 stars•3232 issues•99 pull requests•Updated Sep 1, 2026Sep 1, 2026

• wg-best-practices-os-developers

  Public
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •205205 forks•1.1k1.1k stars•7575 issues•1313 pull requests•Updated Sep 1, 2026Sep 1, 2026

• security-baseline

  Public
  Go

  •

  Apache License 2.0

  •4444 forks•162162 stars•3838 issues•66 pull requests•Updated Sep 1, 2026Sep 1, 2026

• best-practices-badge

  Public
  🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

  railsopen-sourcesecurity+ 7

  railsopen-sourcesecuritybest-practicesfosssupply-chainbadgeflossossfopenssf

  Ruby

  •

  MIT License

  •233233 forks•1.4k1.4k stars•214214 issues•1515 pull requests•Updated Sep 1, 2026Sep 1, 2026

• cve-bin-tool

  Public
  The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl…

  pythonsecurityvulnerability+ 11

  pythonsecurityvulnerabilityvulnerabilitiescvehacktoberfestcvsssecurity-automationsecurity-toolsdevsecops+ 4

  Python

  •

  GNU General Public License v3.0

  •645645 forks•1.8k1.8k stars•152152 issues•7676 pull requests•Updated Sep 1, 2026Sep 1, 2026

• allstar

  Public
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •151151 forks•1.4k1.4k stars•5959 issues•44 pull requests•Updated Aug 31, 2026Aug 31, 2026

• alpha-omega

  Public
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •6767 forks•138138 stars•00 issues•44 pull requests•Updated Aug 31, 2026Aug 31, 2026

• si-tooling

  Public
  Python

  •

  Apache License 2.0

  •44 forks•99 stars•22 issues•00 pull requests•Updated Aug 31, 2026Aug 31, 2026

• scorecard

  Public
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •712712 forks•5.7k5.7k stars•391391 issues•7171 pull requests•Updated Aug 31, 2026Aug 31, 2026

• scorecard-infra

  Public
  OpenSSF Scorecard infrastructure

  Go

  •

  Apache License 2.0

  •11 fork•11 star•55 issues•77 pull requests•Updated Aug 31, 2026Aug 31, 2026

• wg-orbit

  Public
  ORBIT: Open Resources for Baselines, Interoperability, and Tooling

  Apache License 2.0

  •55 forks•3030 stars•44 issues•22 pull requests•Updated Aug 29, 2026Aug 29, 2026

• security-insights

  Public
  Machine-readable specification for the attestation of security-relevant data.

  Go

  •

  Other

  •2020 forks•8181 stars•88 issues•22 pull requests•Updated Aug 28, 2026Aug 28, 2026

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •7474 forks•907907 stars•6666 issues•1818 pull requests•Updated Aug 28, 2026Aug 28, 2026

• criticality_score

  Public
  Gives criticality score for an open source project

  Go

  •

  Apache License 2.0

  •142142 forks•1.5k1.5k stars•4848 issues•4343 pull requests•Updated Aug 27, 2026Aug 27, 2026

• model-signing-spec

  Public
  Model Signing Specification

  Python

  •

  Apache License 2.0

  •66 forks•2828 stars•55 issues•44 pull requests•Updated Aug 26, 2026Aug 26, 2026

• community

  Public
  SCSS

  •

  Creative Commons Attribution 4.0 International

  •88 forks•1111 stars•22 issues•00 pull requests•Updated Aug 25, 2026Aug 25, 2026

• scorecard-action

  Public
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2

  githubsecuritysupply-chaingithub-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •8787 forks•412412 stars•3434 issues•77 pull requests•Updated Aug 24, 2026Aug 24, 2026

• glossary

  Public
  A reference for common terms when talking about OpenSSF and open source software security.

  JavaScript

  •

  Apache License 2.0

  •77 forks•66 stars•33 issues•55 pull requests•Updated Aug 24, 2026Aug 24, 2026

• secure-sw-dev-fundamentals

  Public
  Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

  CSS

  •

  Creative Commons Attribution 4.0 International

  •5252 forks•205205 stars•3535 issues•55 pull requests•Updated Aug 21, 2026Aug 21, 2026

• tac

  Public
  Technical Advisory Council

  Other

  •8484 forks•152152 stars•4444 issues•2727 pull requests•Updated Aug 21, 2026Aug 21, 2026

• orbit-launchpad

  Public
  Apache License 2.0

  •11 fork•44 stars•33 issues•00 pull requests•Updated Aug 20, 2026Aug 20, 2026

• oss-vulnerability-guide

  Public
  A guide on coordinated vulnerability disclosure for open source projects. Includes templates for security policies (security.md) and disclosure notifications.

  HTML

  •

  Creative Commons Attribution 4.0 International

  •4444 forks•141141 stars•55 issues•11 pull request•Updated Aug 19, 2026Aug 19, 2026

• oss-crs-actions

  Public
  Shell

  •00 forks•55 stars•00 issues•00 pull requests•Updated Aug 19, 2026Aug 19, 2026

• wg-globalcyberpolicy

  Public
  Global Cyber Policy Working Group

  Apache License 2.0

  •2222 forks•124124 stars•1212 issues•22 pull requests•Updated Aug 13, 2026Aug 13, 2026

• education

  Public
  OpenSSF Education SIG

  Apache License 2.0

  •1717 forks•2020 stars•44 issues•55 pull requests•Updated Aug 12, 2026Aug 12, 2026