Skip to main content

📩 Stay Updated! Follow us on LinkedIn and join our mailing list for the latest news!

search

Projects

Projects are OpenSSF Technical Initiatives that support the innovative delivery of security tooling and best practices to secure critical open source software.

The OpenSSF Technical Advisory Council is responsible for the oversight of the various Technical Initiatives (TI) and maintains a project lifecycle for hosted projects. Interested in hosting a project?

Allstar

GitHub App that continuously monitors for adherence to security best practices.

Learn More

Best Practices Badge

Best practices for Free/Libre and Open Source Software.

Learn More

Bomctl

Bridging the gap between SBOM generation and SBOM analysis tools.

Learn More

Criticality Score

Assigning a score to create a list of critical open source projects.

Learn More

Fuzz introspector

Improving the fuzzing experience of a project.

Learn More

gittuf

A security layer for Git using concepts introduced by The Update Framework.

Learn More

GUAC

Directed, actionable insights into the security of your software supply chain.

Learn More

Minder

Proactively manage security posture by providing a set of checks and policies.

Learn More

OpenSSF Scorecard

Assess open source projects for security risks through a series of automated checks.

Learn More

OpenVEX

A simplified Vulnerability Exploitability eXchange implementation.

Learn More

OSV Schema

Better vulnerability triage for open source.

Learn More

Package Analysis

Improving the security of open source software by detecting malicious behavior.

Learn More

Protobom

A format-neutral SBOM data representation and I/O library.

Learn More

Repository Service for TUF

Securing content downloads from tampering between repository and client.

Learn More

S2C2F

Guide to securely consume OSS dependencies into dev workflow.

Learn More

SBOMit

Specification of an SBOM format independent method for attesting components.

Learn More

Security Insights Spec

Machine-processable project security information reporting.

Learn More

Sigstore

sigstore is a standard for signing, verifying, and protecting software.

Learn More

SLSA

Safeguarding artifact integrity across any software supply chain.

Learn More

Zarf

Enable continuous software delivery on systems disconnected from the internet.

Learn More

We envision a future where OSS is universally trusted, secure, and reliable. Join us in making open source more secure.

Get Involved
Close Menu