Explore @ossf Open Source projects

Open Source Security Foundation (OpenSSF) (@ossf)

ossf

Stars
11,678
Global Org. Rank 1,991 (Top 0.7 %)
Registered almost 4 years ago
Most used languages

Python
42.3 %

Go
30.8 %

JavaScript
7.7 %

HTML
3.8 %

TypeScript
3.8 %

CSS
3.8 %

Vue 3.8 %

Open Policy Agent 3.8 %
Location 🇺🇸 United States
Country Total Rank 950
Country Ranking

Open Policy Agent 6

Go
129

Vue 355

CSS
654

Python
1,980

JavaScript
2,326

HTML
5,277

TypeScript
9,034

scorecard

OpenSSF Scorecard - Security health metrics for Open Source

criticality_score

Gives criticality score for an open source project

allstar

GitHub App to set and enforce security policies

package-analysis

Open Source Package Analysis

wg-best-practices-os-developers

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

fuzz-introspector

Fuzz Introspector -- introspect, extend and optimise fuzzers

wg-securing-critical-projects

Helping allocate resources to secure the critical open source projects we all depend on.

wg-security-tooling

OpenSSF Security Tooling Working Group

scorecard-action

Official GitHub Action for OpenSSF Scorecard.

wg-metrics-and-metadata

The purpose of the Metrics & Metadata (formerly Identifying Security Threats) working group is to enable stakeholders to have informed confidence in the security of open source projects. We do this by collecting, curating, and communicating relevant metrics and metadata from open source projects and the ecosystems of which they are a part.

malicious-packages

A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

wg-supply-chain-integrity

Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the code they maintain, produce and use.

osv-schema

Open Source Vulnerability schema.

wg-vulnerability-disclosures

The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.

secure-sw-dev-fundamentals

Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

s2c2f

The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.

package-manager-best-practices

Collection of security best practices for package managers.

tac

Technical Advisory Council

security-reviews

A community collection of security reviews of open source software components.

wg-securing-software-repos

OpenSSF Working Group on Securing Software Repositories

package-feeds

Feed parsing for language package manager updates

alpha-omega

Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

Open Policy Agent

foundation

OpenSSF Governance and Legal Docs

Project-Security-Metrics

Collect, curate, and communicate relevant security metrics for open source projects.

sbom-everywhere

Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption

great-mfa-project

The Great Multi-Factor Authentication (MFA) Distribution Project of the Open Source Security Foundation (OpenSSF). We work to distribute hardware MFA tokens to critical open source software (OSS) projects.

security-insights-spec

OPENSSF SECURITY INSIGHTS: Repository for development of the draft standard, where requests for modification should be made via Github Issues.

ai-ml-security

Potential WG on Artificial Intelligence and Machine Learning (AI/ML)

scorecard-monitor

Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

wg-endusers

OpenSSF Endusers Working Group

ossf-landscape

scorecard-webapp

Website and API for OpenSSF Scorecard

DevRel-community

Evangelizing the mission and work of the OpenSSF and building strong community outreach around end-users, open-source maintainers, and contributors.

education

OpenSSF Education SIG

toolbelt

project-template

OpenSSF Project Template

omega-triage-portal

Memory-Safety

scorecard-visualizer

Tool for visualizing the Open SSF Scorecard Api data in a human friendly way

Diagrammers-Society

OpenSSF Diagrammers Society

OpenVEX

Vuln Disclosure WG's new SIG

artwork

OpenSSF Artwork

SIRT

The OSS-SIRT SIG (Open Source Software Security Incident Response Team Special Interest Group) is a group working within the OSSF's Vulnerability Disclosure Working Group that is focused on creating secure vulnerability management capabilities within the open source ecosystem to ensure effective coordinated vulnerability disclosure practices (CVD)

community

gb-planning-committee

The Governing Board Planning Committee guides OpenSSF vision and planning including mission, roadmap, milestones and key metrics for success of the overall organization.

oss-compromises

Archive of various open source security compromises

github-org-access-scraper

GitHub lacks an API for listing an org's repos' access for non-team-based individuals, so, scrape it.

vulnerability-disclosures-whitepaper

Governance-Committee

Governance Committee

oss-researcher-vulnerability-guide

S2C2F-attestation-schema-and-tool

Secure Supply Chain Consumption Framework (S2C2F) OSCAL Catalog and tool

security-metrics-dashboard

disclosure-check

disclosure-check

homebrew-tap

omega-moderne-client

outreach

A place to connect about event and conference engagements

action-web-defn-check

GitHub action for checking a Web Application Definition file

wg-dei

The Diversity, Equity, and Inclusion Working Group was formed in December 2023 to help increase representation and strengthen the overall effectiveness of the cybersecurity workforce.

si-tooling

.github

Github configuration

open-auto-vuln-disclose

open-auto-vuln-disclose

oss-analysis-census2-prototype

Prototype of Census 2 of open source software (NOT MAINTAINED)

scorecard-dependencyanalysis

Scorecard action for checking when new dependencies are added to the repository.