Open Source Security Foundation (OpenSSF)

OpenSSF is a community of software developers and security engineers who are working together to secure open source software for the greater public good.

Verified
We've verified that the organization ossf controls the domain:
- openssf.org
Learn more about verified organizations

Overview
Repositories
Projects
Packages
People

README.md

OpenSSF is committed to working both upstream and with existing communities to advance open source security for all.

We foster collaboration, establish best practices, and develop innovative solutions to secure the development, maintenance, and consumption of open source software. OpenSSF is part of the nonprofit Linux Foundation.

Visit our Projects page (https://openssf.org/projects/)

Working Groups:

AI/ML Security - explore the security risks associated with AI and ML and their impact on open source
Belonging, Empowerment, Allyship, & Representation - foster a more diverse and inclusive cybersecurity workforce
Best Practices for Open Source Developers — provide awareness, education, and guidance about security best practices
Global Cyber Policy - collaborate on cybersecurity-related legislation, frameworks, and standards
Securing Critical Projects — identify and help secure critical open source projects
Securing Software Repositories — strengthen the security posture of software repositories
Security Tooling — identify and provide state of the art, globally accessible security tools
Supply Chain Integrity — ensure the provenance of open source code
Vulnerability Disclosures — enable efficient vulnerability reporting and remediation

For any questions, concerns, reports, etc., please email operations@openssf.org.

Get Involved

Join the OpenSSF Slack
Subscribe to the [OpenSSF monthly newsletter] (https://openssf.org/sign-up/)
Join one of the OpenSSF Mailing Lists
Attend Working Group, Special Interest Group (SIG), and Project meetings, which can be found on our Community Calendar
For more ways to participate, visit our Get Involved page

Membership

We encourage all individual contributors to work with their employers to become members. We aim to grow an active, healthy community of contributors, reviewers, and code owners. Learn more about the requirements and responsibilities of membership in our Membership page or see current members.

Pinned Loading

wg-best-practices-os-developers wg-best-practices-os-developers Public

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

JavaScript 1.1k 204
ai-ml-security ai-ml-security Public

Working Group on Artificial Intelligence and Machine Learning (AI/ML) Security

186 30
wg-securing-critical-projects wg-securing-critical-projects Public

Helping allocate resources to secure the critical open source projects we all depend on.

407 60
wg-securing-software-repos wg-securing-software-repos Public

OpenSSF Working Group on Securing Software Repositories

133 33
tac tac Public

Technical Advisory Council

151 84
foundation foundation Public

OpenSSF Governance and Legal Docs

75 19

Repositories

Type Language Sort

malicious-packages Public
A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

ossf/malicious-packages's past year of commit activity

Go 600 Apache-2.0 131 30 8 Updated Aug 19, 2026
pvtr-github-repo-scanner Public
Privateer plugin for scanning the security hygiene of a GitHub repository.

ossf/pvtr-github-repo-scanner's past year of commit activity

Go 31 Apache-2.0 17 20 5 Updated Aug 19, 2026
allstar Public
GitHub App to set and enforce security policies

ossf/allstar's past year of commit activity

Go 1,443 Apache-2.0 150 58 (20 issues need help) 4 Updated Aug 19, 2026
scorecard Public
OpenSSF Scorecard - Security health metrics for Open Source

ossf/scorecard's past year of commit activity

Go 5,645 Apache-2.0 705 384 (11 issues need help) 62 Updated Aug 19, 2026
scorecard-webapp Public
Website and API for OpenSSF Scorecard

ossf/scorecard-webapp's past year of commit activity

Go 31 Apache-2.0 32 34 (7 issues need help) 11 Updated Aug 19, 2026
scorecard-action Public
Official GitHub Action for OpenSSF Scorecard.

ossf/scorecard-action's past year of commit activity

Go 409 Apache-2.0 87 34 7 Updated Aug 19, 2026
scorecard-infra Public

ossf/scorecard-infra's past year of commit activity

Go 1 Apache-2.0 1 1 1 Updated Aug 19, 2026
oss-vulnerability-guide Public Forked from google/oss-vulnerability-guide
A guide on coordinated vulnerability disclosure for open source projects. Includes templates for security policies (security.md) and disclosure notifications.

ossf/oss-vulnerability-guide's past year of commit activity

HTML 141 CC-BY-4.0 51 5 1 Updated Aug 19, 2026
oss-crs-actions Public

ossf/oss-crs-actions's past year of commit activity

Shell 3 0 0 0 Updated Aug 19, 2026
cve-bin-tool Public
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

ossf/cve-bin-tool's past year of commit activity

Python 1,748 GPL-3.0 645 151 (3 issues need help) 81 Updated Aug 19, 2026