openssf

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

GitGoat is an open source tool that was built to enable DevOps and Engineering teams to design and implement a sustainable misconfiguration prevention strategy. It can be used to test products with access to GitHub repositories without a risk to your production environment.

Format agnostic SBOM tooling

A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.

From the Linux Foundation office in New York City, welcome to "The Untold Stories of Open Source". Each week we explore the people who are supporting Open Source projects, how they became involved with it, and the problems they faced along the way.

Maintained open-source developer cheat sheets for AI, Linux, Git, Python, Docker, Kubernetes, security, and more — plus 31 offline PDFs.

Tool for visualizing the Open SSF Scorecard Api data in a human friendly way

One CLI to guard any OSS project with OpenSSF security best practices — bootstrap, scan, and monitor.

MLSecOps Practical Reference Guide, open-source AI and ML security handbook.

Node.js SDK for OpenSSF scorecard

Hawkeye Agent is an enterprise-grade, AI-native security guardrail that evaluates open-source packages in milliseconds. It gives you a definitive verdict on license compliance, known vulnerabilities (CVE/CVSS), OpenSSF Scorecard health, and deep transitive dependencies (SBOM).

AI code review and issue triage harness for GitHub -- GitHub App, CLI, and Action. Structured context engineering for higher-quality reviews at lower cost.

Secure-by-default governance bundle for GitHub Spec Kit.

Agent Skill for enterprise readiness assessment - security, quality, and automation | Claude Code compatible

OpenSSF Dashboard allows you to check the OpenSSF scorecards for entire organisations and users on GitHub or Gitlab.

90-tool MCP server for software supply chain security — OSV, GHSA, NVD, EPSS, CISA KEV, npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go, deps.dev, Scorecard, Rekor, ClearlyDefined, Repology, typosquatting detection

OSSGuard Python implementation — reference CLI with Rich UI (pip install ossguard)

Track NodeSecure organization issues

OSSGuard Node.js implementation — TypeScript CLI (npx ossguard)

Open-source cryptographic substrate for AI Decision Receipts. Every AI invocation produces a signed, hash-chained, regulator-verifiable receipt. Apache-2.0.