Docs
Open Lodol
DocumentationIntegrationsAPI

OpenSSF Scorecard

App · Compliance & Security · 4 actions

Check how well an open source project is looked after with OpenSSF Scorecard, the Open Source Security Foundation's automated review of a repository's security practices. Score any project on GitHub or GitLab out of 10 and read the checks behind it: is it actively maintained, is code reviewed before it lands, are releases signed, are dependencies pinned and kept up to date, are there known unfixed vulnerabilities. Rank a set of dependencies weakest first, hold a release when one falls below your bar, or put a project's badge in a README. No account or API key is required.

Actions

ActionWhat it does
Check security requirementsAnswer one question about a set of open source projects: do they meet the bar?
Compare repositoriesScore several open source projects at once and rank them weakest first, so the dependency to look at is the one at the top.
Get repository scorecardGet an open source project's OpenSSF Scorecard: its overall score out of 10 and every check behind it, weakest first, so the top of the list is what to fix.
Get scorecard badgeGet a project's OpenSSF Scorecard badge, ready to paste into a README or a status page as Markdown, as HTML, or as the image address on its own.

Check security requirements

Answer one question about a set of open source projects: do they meet the bar? Set a minimum score, optionally name the checks that matter to you, and each project comes back as a pass or a fail with the reasons written out in plain words. Use it to hold a release, open a ticket or send an alert. A project with no published result, a check Scorecard could not evaluate, and a result too old to trust all fail rather than quietly pass, and each says which of the three it was.

Inputs

RepositoriesrepositorieslistRequired
One project per entry, up to 25. Paste an address, or type 'owner/repo' for a project on GitHub. Capitalisation has to match the repository's own, because that is how Scorecard files its results.
Minimum scoreminimum_scorenumberRequired
The lowest score out of 10 a project may have and still pass. It applies to the overall score, and to each of the checks named below.From 0 to 10. Default: 7.
Checks that must passrequired_checkslist
Leave empty to judge on the overall score alone. Choose one or more checks that have to reach the minimum score on their own, whatever the project scores overall. A check Scorecard could not evaluate for a project counts as not met.One or more of: Dangerous-Workflow (Dangerous workflow patterns (critical risk)), Webhooks (Webhook tokens (critical risk)), Binary-Artifacts (Binary artifacts in the source (high risk)), Branch-Protection (Branch protection (high risk)), Code-Review (Human code review (high risk)), Dependency-Update-Tool (Dependency update tool (high risk)), Maintained (Actively maintained (high risk)), Signed-Releases (Signed releases (high risk)), Token-Permissions (Least-privilege workflow tokens (high risk)), Vulnerabilities (Known unfixed vulnerabilities (high risk)), and 10 more.

Outputs

failed_countnumber
failed_repositorieslist
max_scorenumber
minimum_scorenumber
passedtrue/false
passed_countnumber
repository_countnumber
required_checkslist
resultslist
Example output
{
  "failed_count": 0,
  "failed_repositories": [],
  "max_score": 10,
  "minimum_score": 7,
  "passed": true,
  "passed_count": 1,
  "repository_count": 1,
  "required_checks": [
    "License"
  ],
  "results": [
    {
      "analyzed_date": "2026-09-12",
      "analyzed_on": "2026-09-12T01:45:06Z",
      "days_since_analysis": 2,
      "failure_count": 0,
      "failures": [],
      "has_result": true,
      "is_stale": false,
      "max_score": 10,
      "passed": true,
      "report_url": "https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard",
      "repository": "github.com/ossf/scorecard",
      "score": 9
    }
  ]
}

Compare repositories

Score several open source projects at once and rank them weakest first, so the dependency to look at is the one at the top. Each row carries the project's score, how old the analysis is, and the checks it scored worst on. Projects Scorecard has never analysed are listed separately rather than ranked last as though they had scored badly.

Inputs

RepositoriesrepositorieslistRequired
One project per entry, up to 25. Paste an address, or type 'owner/repo' for a project on GitHub. Capitalisation has to match the repository's own, because that is how Scorecard files its results.
Include every checkinclude_checkstrue/false
Turn on to return the full list of checks for each project as well as its score. Off by default, which keeps a comparison to one row per project.Default: false.

Outputs

analyzed_countnumber
average_scorenumber
missing_countnumber
missing_repositorieslist
repositorieslist
repository_countnumber
stale_countnumber
strongest_repositorytext
strongest_scorenumber
weakest_repositorytext
weakest_scorenumber
Example output
{
  "analyzed_count": 1,
  "average_score": 9,
  "missing_count": 0,
  "missing_repositories": [],
  "repositories": [
    {
      "analyzed_date": "2026-09-12",
      "analyzed_on": "2026-09-12T01:45:06Z",
      "check_count": 18,
      "checks": [],
      "days_since_analysis": 2,
      "has_result": true,
      "inconclusive_check_count": 1,
      "is_stale": false,
      "max_score": 10,
      "report_url": "https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard",
      "repository": "github.com/ossf/scorecard",
      "score": 9,
      "weakest_checks": [
        {
          "name": "Branch-Protection",
          "reason": "branch protection is not maximal on development and all release branches",
          "risk": "High",
          "score": 3,
          "title": "Branch protection"
        }
      ]
    }
  ],
  "repository_count": 1,
  "stale_count": 0,
  "strongest_repository": "github.com/ossf/scorecard",
  "strongest_score": 9,
  "weakest_repository": "github.com/ossf/scorecard",
  "weakest_score": 9
}

Get repository scorecard

Get an open source project's OpenSSF Scorecard: its overall score out of 10 and every check behind it, weakest first, so the top of the list is what to fix. Each check says what it looks for, how serious it is, and why it scored what it did. Checks Scorecard could not evaluate are marked as such rather than scored zero, and the date of the analysis comes back with its age, because a result can be years old.

Inputs

RepositoryrepositorytextRequired
The open source project to look at. Paste its address, or type 'owner/repo' for a project on GitHub. Capitalisation has to match the repository's own, because that is how Scorecard files its results.
Checks to includecheckslist
Leave empty for every check Scorecard ran. Choose one or more to return only those. A check that was not run for this project is named rather than left out, so it never reads as a zero.One or more of: Dangerous-Workflow (Dangerous workflow patterns (critical risk)), Webhooks (Webhook tokens (critical risk)), Binary-Artifacts (Binary artifacts in the source (high risk)), Branch-Protection (Branch protection (high risk)), Code-Review (Human code review (high risk)), Dependency-Update-Tool (Dependency update tool (high risk)), Maintained (Actively maintained (high risk)), Signed-Releases (Signed releases (high risk)), Token-Permissions (Least-privilege workflow tokens (high risk)), Vulnerabilities (Known unfixed vulnerabilities (high risk)), and 10 more.
Include the evidenceinclude_evidencetrue/false
Turn on to include the files, settings and commits each check looked at. Off by default: for a large project this runs to hundreds of lines.Default: false.
Commitcommittext
Leave empty for the project's latest result. A full 40-character commit hash returns the result for that exact commit, which exists only for projects that publish their own scorecards.

Outputs

analyzed_datetext
analyzed_ontext
check_countnumber
checkslist
committext
days_since_analysisnumber
inconclusive_check_countnumber
is_staletrue/false
max_scorenumber
missing_checkslist
nametext
ownertext
platformtext
report_urltext
repositorytext
repository_urltext
scorenumber
scorecard_versiontext
Example output
{
  "analyzed_date": "2026-09-12",
  "analyzed_on": "2026-09-12T01:45:06Z",
  "check_count": 18,
  "checks": [
    {
      "description": "Determines if the default and release branches are protected with GitHub's branch protection settings.",
      "documentation_url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection",
      "evidence": [],
      "inconclusive": false,
      "max_score": 10,
      "name": "Branch-Protection",
      "reason": "branch protection is not maximal on development and all release branches",
      "risk": "High",
      "score": 3,
      "title": "Branch protection"
    }
  ],
  "commit": "f92023a3f77879f96e0c9c1305f289d755be4bb6",
  "days_since_analysis": 2,
  "inconclusive_check_count": 1,
  "is_stale": false,
  "max_score": 10,
  "missing_checks": [],
  "name": "scorecard",
  "owner": "ossf",
  "platform": "github.com",
  "report_url": "https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard",
  "repository": "github.com/ossf/scorecard",
  "repository_url": "https://github.com/ossf/scorecard",
  "score": 9,
  "scorecard_version": "v5.5.0"
}

Get scorecard badge

Get a project's OpenSSF Scorecard badge, ready to paste into a README or a status page as Markdown, as HTML, or as the image address on its own. Every form links through to the full report. Because a badge renders as an error for a project Scorecard has never analysed, this also reports the current score and says plainly whether the badge will show one.

Inputs

RepositoryrepositorytextRequired
The open source project to look at. Paste its address, or type 'owner/repo' for a project on GitHub. Capitalisation has to match the repository's own, because that is how Scorecard files its results.

Outputs

analyzed_ontext
badge_urltext
has_resulttrue/false
htmltext
markdowntext
max_scorenumber
report_urltext
repositorytext
scorenumber
Example output
{
  "analyzed_on": "2026-09-12T01:45:06Z",
  "badge_url": "https://img.shields.io/ossf-scorecard/github.com/ossf/scorecard?label=openssf+scorecard&style=flat",
  "has_result": true,
  "html": "<a href=\"https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard\"><img src=\"https://img.shields.io/ossf-scorecard/github.com/ossf/scorecard?label=openssf+scorecard&style=flat\" alt=\"OpenSSF Scorecard\"></a>",
  "markdown": "[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/ossf/scorecard?label=openssf+scorecard&style=flat)](https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard)",
  "max_score": 10,
  "report_url": "https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard",
  "repository": "github.com/ossf/scorecard",
  "score": 9
}

OpenSky Network

Previous Page

OpenStreetMap Nominatim

Next Page

On this page

ActionsCheck security requirementsCompare repositoriesGet repository scorecardGet scorecard badge