OpenSSF Scorecard

Operate build + CI/CD security per OpenSSF Scorecard checks Token-Permissions + Dangerous-Workflow + CI-Tests + CII-Best-Practices. Token Permissions in Workflows must (a) restrict GITHUB_TOKEN to minimum permissions per workflow + (b) avoid blanket write-all + (c) verify scope of permissions per job + step. Dangerous Workflow Patterns Absent must avoid (a) untrusted code checkout via pull_request_target with checkout of PR head + (b) script injection via expressions referencing untrusted input + (c) other dangerous patterns documented by Scorecard. Continuous Integration Tests must (a) verify tests run on every PR + (b) tests cover meaningful functionality + (c) tests provide signal for merge gating. Build provenance must (a) generate SLSA provenance for releases per applicable SLSA level + (b) sign provenance + verify at consumption. Packaging via Trusted Publishers must (a) use OIDC-b

• OpenSSF Scorecard evidence for OSSFSC-3

• compliance nominal not operational

Operate dependency management per OpenSSF Scorecard checks Dependency-Update-Tool + Pinned-Dependencies + Vulnerabilities. Dependency Update Tool Active must (a) verify Dependabot + Renovate + or equivalent is configured + (b) maintains dependency update PRs + (c) integrates with CI for verification. Pinned Dependencies must (a) pin dependencies to specific versions or commit SHAs rather than tag references for actions + container images + scripts + packages + (b) verify pinning across workflow files + Dockerfiles + scripts + package manifests. Vulnerabilities Free of Known Critical Issues must (a) scan dependencies + container images + transitive deps against vulnerability databases (OSV + CVE + GHSA + npm advisory + PyPA + similar) + (b) maintain remediation within SLA aligned with severity + (c) align with broader vulnerability management programme. Maintain SBOM Generation and Public

• OpenSSF Scorecard evidence for OSSFSC-2

• compliance nominal not operational

Operate project maintenance + sustainability + supply chain integration per OpenSSF Scorecard + broader supply chain security frameworks. Maintained Project must (a) maintain regular commits + releases + issue triage + (b) avoid project becoming abandoned + (c) plan succession + maintainer onboarding + (d) coordinate with OpenSSF Alpha-Omega + similar sustainability initiatives where applicable. Integration with broader supply chain security must (a) align with NIST SP 800-161 SCRM + SLSA + S2C2F + Sigstore + (b) integrate Scorecard with broader OSPO + procurement + dependency review processes + (c) feed Scorecard signals into vulnerability management + (d) coordinate with downstream consumers on security improvements. Maintain project documentation + onboarding + community guidelines + Code of Conduct + with broader governance per CHAOSS metrics + Linux Foundation project governance + s

• OpenSSF Scorecard evidence for OSSFSC-8

• compliance nominal not operational

Maintain release integrity + provenance per OpenSSF Scorecard checks Signed-Releases + Binary-Artifacts + Packaging. Signed Releases must (a) sign release artifacts with cryptographic signature (Sigstore + GPG + Cosign + similar) + (b) publish public key or verify via transparency log + (c) integrate signature verification into consumer workflow. Binary Artifacts Absent from Repository must (a) avoid committing binary artifacts to source repository + (b) use artifact repositories for binary distribution + (c) document exceptions where binaries are necessary. Packaging via Trusted Publishers extends OSSFSC-3 ensuring (a) packages published via OIDC-based trusted publishing + (b) avoid long-lived publishing credentials, (c) verify package provenance at consumption. License Declared must (a) declare project license in standard location (LICENSE file + package metadata) + (b) align with SPDX

• OpenSSF Scorecard evidence for OSSFSC-6

• compliance nominal not operational

Implement branch protection + code review + repository governance per OpenSSF Scorecard checks Branch-Protection + Code-Review + Maintained. Branch protection must (a) require pull requests + (b) require reviewers (typically 1 minimum + 2 for high-impact branches) + (c) require status checks to pass + (d) require up-to-date branches + (e) restrict force pushes + (f) restrict deletion + (g) include administrators per Scorecard scoring. Code Review on Changes must verify (a) PRs have approving review from required reviewers + (b) review is by collaborator with write access + (c) self-merge restrictions where appropriate. Maintained Project assesses (a) recent commits + (b) release cadence + (c) issue triage activity + (d) project is not archived + with documented sustainability practice. Integrate with broader Software Development Lifecycle governance + with documented exception management

• OpenSSF Scorecard evidence for OSSFSC-1

• compliance nominal not operational

Maintain security policy + vulnerability disclosure programme per OpenSSF Scorecard check Security-Policy + broader VDP best practice. Security Policy Published must (a) publish SECURITY.md file documenting reporting channel + scope + acknowledgment timeline + response process + (b) integrate with PSIRT or equivalent triage capability + (c) align with broader vulnerability disclosure programme + (d) honor responsible disclosure conventions. Vulnerability disclosure programme must (a) provide secure reporting channel (security@ email + Bugcrowd + HackerOne + similar) + (b) acknowledge reports within documented timeframe (typically 1-3 business days) + (c) triage + scope + remediate + coordinate disclosure + (d) recognize researcher contribution where appropriate. Integrate with broader product security operations + bug bounty + threat intelligence + customer communication.

• OpenSSF Scorecard evidence for OSSFSC-4

• compliance nominal not operational

Operate static analysis + fuzzing + testing per OpenSSF Scorecard checks SAST + Fuzzing + CI-Tests. Static Analysis SAST must (a) run SAST on every PR + (b) detect common security vulnerabilities (injection + authentication + authorisation + crypto + secrets + supply chain) + (c) integrate with code review gating + (d) align with broader SDLC security testing. Fuzzing must (a) operate fuzzing on appropriate components (parsers + network protocols + cryptographic routines + complex input handlers) + (b) integrate with OSS-Fuzz or equivalent + (c) maintain corpus + regression tracking + (d) coordinate fuzzing-found vulnerabilities with VDP + remediation. Test coverage must (a) measure test coverage + (b) maintain coverage thresholds for security-critical code + (c) treat coverage gaps in security boundaries as remediation priorities.

• OpenSSF Scorecard evidence for OSSFSC-5

• compliance nominal not operational

Operate webhook authentication + contributors diversity + aggregate scoring per OpenSSF Scorecard checks Webhooks + Contributors + aggregate score. Webhooks Authenticated must (a) verify webhook authentication tokens at endpoints + (b) avoid unauthenticated webhook endpoints + (c) rotate webhook secrets + (d) monitor webhook abuse. Contributors From Multiple Organisations assesses (a) presence of contributors from multiple organisations indicating broader project sustainability + (b) is a sustainability signal not security control directly. Aggregate Scorecard Score and Threshold must (a) compute aggregate Scorecard score from individual check results + (b) maintain score threshold appropriate to project criticality + (c) integrate score with consumption decisions + dependency review + procurement + (d) track score over time + with improvement objectives. Use Scorecard as continuous indi

• OpenSSF Scorecard evidence for OSSFSC-7

• compliance nominal not operational