awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
ossf avatar

ossf/scorecard

0
View on GitHub↗
scorecard.dev↗

Scorecard

Scorecard is an open source security scanner and software supply chain analysis tool that evaluates the security posture of projects by calculating risk metrics based on best practices. It functions as a security health dashboard, visualizing security gaps through scores and badges to help maintainers identify vulnerabilities.

The project provides a system for monitoring repository security through a GitHub Action security auditor that alerts maintainers when security scores drop. It also offers a mechanism for vulnerability remediation guidance, mapping identified security gaps to prescriptive instructions for improving development practices.

The tool covers a broad capability surface including open source security auditing, CI/CD security automation, and the analysis of third party repositories to assess risk before integration. It supports various interfaces for interaction, including a command line interface for scanning and a REST interface for retrieving precalculated security metrics.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • Open Source Security Scanners - Evaluates the security posture of open source projects by calculating risk metrics based on industry best practices.
  • Security Posture Checklists - Evaluates source code and build processes to generate an aggregate security score and risk level.
  • Security Auditors - Provides a GitHub Action that monitors repository changes and alerts maintainers when security scores drop.
  • CI/CD Security Metrics Automation - Integrates security health checks into CI pipelines to detect regressions and alert maintainers.
  • Open Source Security - Evaluates the security posture of open source projects by scanning code and build processes.
  • Security Guides - Provides specific prompts and instructions to resolve identified security gaps.
  • Repository Security Health Tracking - Tracks security scores over time using automated badges and reports to maintain project posture.
  • Remediation Guidance - Maps security failures to prescriptive instructions to help maintainers improve their project's security posture.
  • Software Supply Chain Security - Analyzes third party dependencies and repositories to assess risk in the software supply chain.
  • Third Party Dependency Risk Assessment - Scans third-party repositories to assess their security posture before they are added as dependencies.
  • Security Findings Visualizations - Renders detailed graphical security analyses to help users identify and resolve security gaps.
  • Visual Badges - Generates auto-updating visual badges for project documentation to represent security ratings.
  • Repository Content Scanning - Enables security analysis of target projects via a terminal interface using repository links.
  • CLI Scanning Interfaces - Provides a command line interface to execute security evaluations on target projects.
  • Security Analysis Dashboards - Visualizes security gaps through scores, badges, and remediation guidance via a dedicated reporting interface.
  • Security Monitoring - Integrates security scanning into version control workflows to issue alerts on repository changes.
  • Automated Security Scan Triggers - Automates security scans on every code commit through CI pipelines to alert maintainers of regressions.
  • GitHub Actions - Integrates security checks as a GitHub Action workflow step for immediate feedback on changes.
  • Security Automation Tools - Automates analysis of the security posture of open source projects.
  • Application Security - Provides security health metrics for open source projects.
  • Security and Vulnerability Scanning - Provides security health metrics for open source projects.
5,527 stars·665 forks·Go·Apache-2.0·28 views

Star history

Star history chart for ossf/scorecardStar history chart for ossf/scorecard

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does ossf/scorecard do?

Scorecard is an open source security scanner and software supply chain analysis tool that evaluates the security posture of projects by calculating risk metrics based on best practices. It functions as a security health dashboard, visualizing security gaps through scores and badges to help maintainers identify vulnerabilities.

What are the main features of ossf/scorecard?

The main features of ossf/scorecard are: Open Source Security Scanners, Security Posture Checklists, Security Auditors, CI/CD Security Metrics Automation, Open Source Security, Security Guides, Repository Security Health Tracking, Remediation Guidance.

Which projects share features with ossf/scorecard?

Projects with overlapping indexed features include: kubescape/kubescape — Kubescape is a Kubernetes security posture management platform designed to scan clusters, manifests, and images for… github/advisory-database — The advisory database is a centralized repository and intelligence platform designed to aggregate, normalize, and… snyk/snyk — Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source… lyft/cartography — Cartography is a graph-based infrastructure visualization and security analysis framework. It ingests data from… 1n3/sn1per — Sn1per is a vulnerability management platform and penetration testing orchestrator designed to automate… anchore/grype — Grype is a command-line security scanner designed to identify known vulnerabilities within container images,…

Projects sharing features with Scorecard

These projects share indexed features with Scorecard. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • kubescape/kubescapekubescape avatar

    kubescape/kubescape

    11,489View on GitHub↗

    Kubescape is a Kubernetes security posture management platform designed to scan clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance risks. It functions as a comprehensive security suite incorporating a compliance scanner, a container image vulnerability scanner, an admission controller for policy enforcement, and a runtime security monitor. The platform distinguishes itself through runtime-aware vulnerability filtering, which maps libraries loaded in memory to determine if vulnerabilities are actually reachable. It also integrates with AI assistants via a Mo

    Gobest-practicedevopskubernetes
    View on GitHub↗11,489
  • github/advisory-databasegithub avatar

    github/advisory-database

    2,337View on GitHub↗

    The advisory database is a centralized repository and intelligence platform designed to aggregate, normalize, and track security vulnerability data across diverse open source software ecosystems. It functions as a unified source of truth for security advisories, providing machine-readable records that help developers and automated tools identify and manage threats within their software supply chains. The platform distinguishes itself by utilizing a version-controlled, git-based storage model that relies on pull-request-driven workflows for community curation and verification. By enforcing a s

    View on GitHub↗2,337
  • lyft/cartographylyft avatar

    lyft/cartography

    3,926View on GitHub↗

    Cartography is a graph-based infrastructure visualization and security analysis framework. It ingests data from diverse cloud, identity, and software-as-a-service providers to model complex relationships between resources, users, and security findings within a centralized graph database. By mapping these interdependencies, the platform enables organizations to gain visibility into their environment and identify potential security risks through graph traversal queries. The platform distinguishes itself through its ontology-based normalization and cross-platform entity correlation, which map he

    Python
    View on GitHub↗3,926
  • snyk/snyksnyk avatar

    snyk/snyk

    5,586View on GitHub↗

    Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source code, open-source dependencies, container images, and infrastructure-as-code configurations. It functions as a comprehensive security workflow automation tool, utilizing a static analysis engine and dependency graph mapping to detect security flaws and license compliance issues throughout the software development lifecycle. The platform distinguishes itself through agentic workflow orchestration and an automated remediation pipeline that generates and submits pull requests to patc

    TypeScript
    View on GitHub↗5,586
Compare all 30 related projects→