OpenSSF Scorecard

1. Binary-Artifacts

   Checks that repositories do not contain binary artifacts.

2. Branch-Protection

   Checks branch protection settings on default branches.

3. Code-Review

   Checks that changes are reviewed before merging.

4. Dangerous-Workflow

   Detects risky GitHub Actions patterns such as untrusted input in scripts.

5. Dependency-Update-Tool

   Checks for Dependabot or Renovate.

6. Fuzzing

   Checks whether the project uses fuzzing.

7. Pinned-Dependencies

   Checks that dependencies and actions are pinned by hash.

8. SAST

   Checks for static analysis in CI.

9. Security-Policy

   Checks for SECURITY.md.

10. Signed-Releases

    Checks that releases are signed or have provenance.

11. Token-Permissions

    Checks least-privilege CI token permissions.

12. Vulnerabilities

    Checks for known unfixed vulnerabilities.

13. Maintained

    Checks project activity.

14. SBOM

    Checks whether releases include an SBOM.

15. CII-Best-Practices

    Checks for the OpenSSF Best Practices badge.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• CIS Benchmarks
• CIS Critical Security Controls
• CISA Secure by Design
• CycloneDX
• NIST SSDF (SP 800-218)
• SLSA
• SPDX
• Threat Modeling (OWASP and STRIDE)
• Zero Trust (NIST SP 800-207)