OpenSSF

OpenSSF Announces The Alpha-Omega Project to Improve Software Supply Chain Security for 10,000 OSS Projects

Following a meeting with government and industry leaders at the White House, OpenSSF is excited to announce the Alpha-Omega Project to improve the security posture of open source software (OSS)...

Reducing Security Risks in Open Source Software at Scale: Scorecards Launches V4

Authors: Best Practices Working Group, Laurent Simon (Google), Azeem Shaikh (Google), and Jose Palafox (GitHub) Today, two members of the Open Source Security Foundation, Google and GitHub, are partnering to...

The OpenSSF and the Linux Foundation Address Software Supply Chain Security Challenges at White House Summit

Today marks an important moment in the Linux Foundation’s history of engagement with public sector organizations. The White House convened an important cross-section of the Open Source developer and commercial...

Securing Critical Open Source Projects with Multifactor Authentication

The Open Source Security Foundation (OpenSSF) Developer Best Practices Working Group has undertaken a project to improve the overall security and integrity of critical open source software projects and their...

The World’s Major Technology Providers Converge to Improve the Security of Software Supply Chains

Imagine you have created an open source project that has become incredibly popular.  Thousands, if not millions, of developers worldwide, rely on the lines of code that you wrote. You...

Open Source Security Foundation Raises $10 Million in New Commitments to Secure Software Supply Chains

Announcing the OpenSSF Vulnerability Disclosure WG guide to disclosure for OSS projects

Authors: Anne Bertucio, Christopher Robinson, David Wheeler, OpenSSF Vulnerability Disclosure WG members https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md Vulnerability disclosure is the process of reporting, remediating, and communicating the details of a discovered vulnerability.  This...

Introducing the Allstar GitHub App

Authors: Mike Maraya, Jeff Mendoza We’re excited to announce Allstar, a GitHub app that provides automated continuous enforcement of security best practices for GitHub projects. With Allstar, owners can check...

How LF communities enable security measures required by the US Executive Order on Cybersecurity

Our communities take security seriously and have been instrumental in creating the tools and standards that every organization needs to comply with the recent US Executive Order Overview The US...