Repositories list

• oss-crs

  Public

  ossf/oss-crs’s past year of commit activity
  Cyber Reasoning Systems for Bug-Finding and Patching in Open Source Software

  Python

  •

  MIT License

  •3535 forks in ossf/oss-crs•172172 stars in ossf/oss-crs•3232 issues in ossf/oss-crs•1414 pull requests in ossf/oss-crs•Updated Oct 19, 2026Oct 19, 2026

• malicious-packages

  Public

  ossf/malicious-packages’s past year of commit activity
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •163163 forks in ossf/malicious-packages•630630 stars in ossf/malicious-packages•3838 issues in ossf/malicious-packages•2828 pull requests in ossf/malicious-packages•Updated Oct 19, 2026Oct 19, 2026

• scorecard

  Public

  ossf/scorecard’s past year of commit activity
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •748748 forks in ossf/scorecard•5.8k5.8k stars in ossf/scorecard•401401 issues in ossf/scorecard•6565 pull requests in ossf/scorecard•Updated Oct 19, 2026Oct 19, 2026

• allstar

  Public

  ossf/allstar’s past year of commit activity
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •156156 forks in ossf/allstar•1.5k1.5k stars in ossf/allstar•5959 issues in ossf/allstar•1313 pull requests in ossf/allstar•Updated Oct 19, 2026Oct 19, 2026

• best-practices-badge

  Public

  ossf/best-practices-badge’s past year of commit activity
  🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

  railsopen-sourcesecurity+ 7

  railsopen-sourcesecuritybest-practicesfosssupply-chainbadgeflossossfopenssf

  Ruby

  •

  MIT License

  •236236 forks in ossf/best-practices-badge•1.4k1.4k stars in ossf/best-practices-badge•218218 issues in ossf/best-practices-badge•2020 pull requests in ossf/best-practices-badge•Updated Oct 19, 2026Oct 19, 2026

• security-baseline

  Public

  ossf/security-baseline’s past year of commit activity
  Go

  •

  Apache License 2.0

  •4343 forks in ossf/security-baseline•168168 stars in ossf/security-baseline•3838 issues in ossf/security-baseline•22 pull requests in ossf/security-baseline•Updated Oct 19, 2026Oct 19, 2026

• cve-bin-tool

  Public

  ossf/cve-bin-tool’s past year of commit activity
  The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl…

  pythonsecurityvulnerability+ 11

  pythonsecurityvulnerabilityvulnerabilitiescvehacktoberfestcvsssecurity-automationsecurity-toolsdevsecops+ 4

  Python

  •

  GNU General Public License v3.0

  •683683 forks in ossf/cve-bin-tool•1.8k1.8k stars in ossf/cve-bin-tool•154154 issues in ossf/cve-bin-tool•8989 pull requests in ossf/cve-bin-tool•Updated Oct 19, 2026Oct 19, 2026

• scorecard-action

  Public

  ossf/scorecard-action’s past year of commit activity
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2

  githubsecuritysupply-chaingithub-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •9191 forks in ossf/scorecard-action•424424 stars in ossf/scorecard-action•3434 issues in ossf/scorecard-action•33 pull requests in ossf/scorecard-action•Updated Oct 17, 2026Oct 17, 2026

• glossary

  Public

  ossf/glossary’s past year of commit activity
  A reference for common terms when talking about OpenSSF and open source software security.

  JavaScript

  •

  Apache License 2.0

  •77 forks in ossf/glossary•66 stars in ossf/glossary•33 issues in ossf/glossary•99 pull requests in ossf/glossary•Updated Oct 16, 2026Oct 16, 2026

• scorecard-webapp

  Public

  ossf/scorecard-webapp’s past year of commit activity
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  openssf-scorecard

  HTML

  •

  Apache License 2.0

  •3535 forks in ossf/scorecard-webapp•3333 stars in ossf/scorecard-webapp•3535 issues in ossf/scorecard-webapp•2323 pull requests in ossf/scorecard-webapp•Updated Oct 16, 2026Oct 16, 2026

• scorecard-infra

  Public

  ossf/scorecard-infra’s past year of commit activity
  OpenSSF Scorecard infrastructure

  Go

  •

  Apache License 2.0

  •44 forks in ossf/scorecard-infra•33 stars in ossf/scorecard-infra•1313 issues in ossf/scorecard-infra•88 pull requests in ossf/scorecard-infra•Updated Oct 15, 2026Oct 15, 2026

• security-insights

  Public

  ossf/security-insights’s past year of commit activity
  Machine-readable specification for the attestation of security-relevant data.

  JavaScript

  •

  Other

  •2222 forks in ossf/security-insights•8282 stars in ossf/security-insights•88 issues in ossf/security-insights•11 pull request in ossf/security-insights•Updated Oct 15, 2026Oct 15, 2026

• oss-crs-actions

  Public
  Shell

  •

  Apache License 2.0

  •11 fork in ossf/oss-crs-actions•55 stars in ossf/oss-crs-actions•00 issues in ossf/oss-crs-actions•33 pull requests in ossf/oss-crs-actions•Updated Oct 15, 2026Oct 15, 2026

• pvtr-github-repo-scanner

  Public

  ossf/pvtr-github-repo-scanner’s past year of commit activity
  Privateer plugin for scanning the security hygiene of a GitHub repository.

  Go

  •

  Apache License 2.0

  •2222 forks in ossf/pvtr-github-repo-scanner•3232 stars in ossf/pvtr-github-repo-scanner•1818 issues in ossf/pvtr-github-repo-scanner•33 pull requests in ossf/pvtr-github-repo-scanner•Updated Oct 15, 2026Oct 15, 2026

• osv-schema

  Public

  ossf/osv-schema’s past year of commit activity
  Open Source Vulnerability schema.

  Go

  •

  Apache License 2.0

  •134134 forks in ossf/osv-schema•272272 stars in ossf/osv-schema•5252 issues in ossf/osv-schema•99 pull requests in ossf/osv-schema•Updated Oct 14, 2026Oct 14, 2026

• security-assessments

  Public

  ossf/security-assessments’s past year of commit activity
  Python

  •

  Apache License 2.0

  •77 forks in ossf/security-assessments•2323 stars in ossf/security-assessments•55 issues in ossf/security-assessments•11 pull request in ossf/security-assessments•Updated Oct 14, 2026Oct 14, 2026

• community

  Public

  ossf/community’s past year of commit activity
  SCSS

  •

  Creative Commons Attribution 4.0 International

  •1010 forks in ossf/community•1111 stars in ossf/community•22 issues in ossf/community•66 pull requests in ossf/community•Updated Oct 14, 2026Oct 14, 2026

• si-tooling

  Public

  ossf/si-tooling’s past year of commit activity
  Go

  •

  Apache License 2.0

  •55 forks in ossf/si-tooling•99 stars in ossf/si-tooling•00 issues in ossf/si-tooling•00 pull requests in ossf/si-tooling•Updated Oct 14, 2026Oct 14, 2026

• tac

  Public

  ossf/tac’s past year of commit activity
  Technical Advisory Council

  Other

  •8888 forks in ossf/tac•153153 stars in ossf/tac•4747 issues in ossf/tac•1313 pull requests in ossf/tac•Updated Oct 13, 2026Oct 13, 2026

• wg-japan

  Public

  ossf/wg-japan’s past year of commit activity
  Japan Working Group

  Apache License 2.0

  •00 forks in ossf/wg-japan•00 stars in ossf/wg-japan•00 issues in ossf/wg-japan•00 pull requests in ossf/wg-japan•Updated Oct 13, 2026Oct 13, 2026

• ossf-landscape

  Public

  ossf/ossf-landscape’s past year of commit activity
  Apache License 2.0

  •3030 forks in ossf/ossf-landscape•3434 stars in ossf/ossf-landscape•00 issues in ossf/ossf-landscape•00 pull requests in ossf/ossf-landscape•Updated Oct 6, 2026Oct 6, 2026

• wg-best-practices-os-developers

  Public

  ossf/wg-best-practices-os-developers’s past year of commit activity
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •208208 forks in ossf/wg-best-practices-os-developers•1.1k1.1k stars in ossf/wg-best-practices-os-developers•7575 issues in ossf/wg-best-practices-os-developers•1818 pull requests in ossf/wg-best-practices-os-developers•Updated Oct 5, 2026Oct 5, 2026

• ai-ml-security

  Public

  ossf/ai-ml-security’s past year of commit activity
  Working Group on Artificial Intelligence and Machine Learning (AI/ML) Security

  Apache License 2.0

  •3131 forks in ossf/ai-ml-security•194194 stars in ossf/ai-ml-security•77 issues in ossf/ai-ml-security•00 pull requests in ossf/ai-ml-security•Updated Oct 4, 2026Oct 4, 2026

• alpha-omega

  Public

  ossf/alpha-omega’s past year of commit activity
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •6868 forks in ossf/alpha-omega•143143 stars in ossf/alpha-omega•00 issues in ossf/alpha-omega•00 pull requests in ossf/alpha-omega•Updated Oct 1, 2026Oct 1, 2026

• orbit-definitions

  Public
  Creative Commons Attribution 4.0 International

  •00 forks in ossf/orbit-definitions•00 stars in ossf/orbit-definitions•00 issues in ossf/orbit-definitions•00 pull requests in ossf/orbit-definitions•Updated Sep 29, 2026Sep 29, 2026

• wg-orbit

  Public

  ossf/wg-orbit’s past year of commit activity
  ORBIT: Open Resources for Baselines, Interoperability, and Tooling

  Apache License 2.0

  •55 forks in ossf/wg-orbit•3131 stars in ossf/wg-orbit•44 issues in ossf/wg-orbit•22 pull requests in ossf/wg-orbit•Updated Sep 29, 2026Sep 29, 2026

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •7575 forks in ossf/package-analysis•921921 stars in ossf/package-analysis•6767 issues in ossf/package-analysis•2222 pull requests in ossf/package-analysis•Updated Sep 25, 2026Sep 25, 2026

• wg-globalcyberpolicy

  Public

  ossf/wg-globalcyberpolicy’s past year of commit activity
  Global Cyber Policy Working Group

  Apache License 2.0

  •2222 forks in ossf/wg-globalcyberpolicy•137137 stars in ossf/wg-globalcyberpolicy•1717 issues in ossf/wg-globalcyberpolicy•00 pull requests in ossf/wg-globalcyberpolicy•Updated Sep 25, 2026Sep 25, 2026

• wg-sbom-vex

  Public

  ossf/wg-sbom-vex’s past year of commit activity
  SBOM-VEX Working Group

  00 forks in ossf/wg-sbom-vex•00 stars in ossf/wg-sbom-vex•00 issues in ossf/wg-sbom-vex•00 pull requests in ossf/wg-sbom-vex•Updated Sep 25, 2026Sep 25, 2026

• model-signing-spec

  Public

  ossf/model-signing-spec’s past year of commit activity
  Model Signing Specification

  Python

  •

  Apache License 2.0

  •66 forks in ossf/model-signing-spec•3030 stars in ossf/model-signing-spec•66 issues in ossf/model-signing-spec•44 pull requests in ossf/model-signing-spec•Updated Sep 18, 2026Sep 18, 2026