ossf/scorecard
Scorecard
Scorecard ist ein Open-Source-Sicherheitsscanner und ein Tool zur Analyse der Software-Lieferkette, das den Sicherheitsstatus von Projekten durch die Berechnung von Risikometriken basierend auf Best Practices bewertet. Es fungiert als Dashboard für die Sicherheitsgesundheit und visualisiert Sicherheitslücken durch Scores und Badges, um Maintainer bei der Identifizierung von Schwachstellen zu unterstützen.
Das Projekt bietet ein System zur Überwachung der Repository-Sicherheit durch einen GitHub-Action-Sicherheitsauditor, der Maintainer alarmiert, wenn Sicherheits-Scores sinken. Es bietet zudem einen Mechanismus für Anleitungen zur Behebung von Schwachstellen, der identifizierte Sicherheitslücken auf präskriptive Anweisungen zur Verbesserung der Entwicklungspraktiken abbildet.
Das Tool deckt eine breite Oberfläche an Funktionen ab, einschließlich Open-Source-Sicherheitsaudits, CI/CD-Sicherheitsautomatisierung und der Analyse von Drittanbieter-Repositories zur Risikobewertung vor der Integration. Es unterstützt verschiedene Schnittstellen für die Interaktion, einschließlich eines Command-Line-Interfaces für Scans und eines REST-Interfaces zum Abrufen vorab berechneter Sicherheitsmetriken.
Features
- Open Source Security Scanners - Evaluates the security posture of open source projects by calculating risk metrics based on industry best practices.
- Security Posture Checklists - Evaluates source code and build processes to generate an aggregate security score and risk level.
- Security Auditors - Provides a GitHub Action that monitors repository changes and alerts maintainers when security scores drop.
- CI/CD Security Metrics Automation - Integrates security health checks into CI pipelines to detect regressions and alert maintainers.
- Open Source Security - Evaluates the security posture of open source projects by scanning code and build processes.
- Security Guides - Provides specific prompts and instructions to resolve identified security gaps.
- Repository Security Health Tracking - Tracks security scores over time using automated badges and reports to maintain project posture.
- Remediation Guidance - Maps security failures to prescriptive instructions to help maintainers improve their project's security posture.
- Software Supply Chain Security - Analyzes third party dependencies and repositories to assess risk in the software supply chain.
- Third Party Dependency Risk Assessment - Scans third-party repositories to assess their security posture before they are added as dependencies.
- Security Findings Visualizations - Renders detailed graphical security analyses to help users identify and resolve security gaps.
- Visual Badges - Generates auto-updating visual badges for project documentation to represent security ratings.
- Repository Content Scanning - Enables security analysis of target projects via a terminal interface using repository links.
- CLI Scanning Interfaces - Provides a command line interface to execute security evaluations on target projects.
- Security Analysis Dashboards - Visualizes security gaps through scores, badges, and remediation guidance via a dedicated reporting interface.
- Security Monitoring - Integrates security scanning into version control workflows to issue alerts on repository changes.
- Automated Security Scan Triggers - Automates security scans on every code commit through CI pipelines to alert maintainers of regressions.
- GitHub Actions - Integrates security checks as a GitHub Action workflow step for immediate feedback on changes.
- Security Automation Tools - Automates analysis of the security posture of open source projects.
- Application Security - Provides security health metrics for open source projects.
- Security and Vulnerability Scanning - Provides security health metrics for open source projects.
