scorecard - OpenSSF Security Scorecard

The scorecard module evaluates open-source projects based on security best practices, providing a score and detailed report on potential risks like binary artifacts, unreviewed code, or dangerous workflows.

When to Activate

• When the user wants to assess the security level of an open-source repository.
• When performing due diligence on a new dependency (npm, PyPI, etc.).
• When auditing a local repository for security improvements.

Core Principles & Rules

• Best Practices: Focuses on identifying risks like lack of CI tests, missing branch protection, or pinned dependencies.
• Detailed Reporting: Use --show-details to understand why specific checks passed or failed.

Patterns & Examples