About this site

OpenSSF Project Community is a role- and problem-first way to navigate the projects the Open Source Security Foundation ships. Rather than ask visitors to read a stack of separate project READMEs and work out which ones apply to them, this site lets you start from whichever angle fits how you think: your role, the problem you’re solving, or a specific project.

How the site is built

Everything renders from four record types in data/:

• Personas (6) — the roles that touch the OpenSSF toolchain.
• Problems (8) — the security problems those projects address.
• Projects (23) — each declaring which personas and problems it addresses (with a sentence of prose for each), plus links to similar and complementary projects.
• Publications (11) — the specifications, frameworks, and formats of the ecosystem, from SLSA and the OSPS Baseline to SBOM and VEX, linked to the projects that produce, consume, or implement them.

Personas and problems are never linked directly — that relationship is derived through projects. A persona page surfaces the problems its projects solve; a problem page surfaces the personas who care.

Personas

• Software Developer / Maintainer — Developer

• Open Source Professional (OSPO) — OSPO

• Security Engineer / Architect — Security

• CI/CD DevOps & Tooling Integrator — DevOps

• Package & Repository Manager — Package Manager

• Executive / End-User Consumer — Executive

Problems

• Build & Provenance Integrity — Build Integrity

• Artefact Signing & Verification — Signing

• Dependency & SBOM Visibility — Visibility

• Vulnerability Management — Vulnerabilities

• Secure Repository Configuration — Configuration

• Measuring Security Posture — Posture

• Policy & Compliance Enforcement — Compliance

• Secrets Management — Secrets

Projects

• Best Practices Badge — project site ↗

• Bomctl — project site ↗

• Criticality Score — project site ↗

• Fuzz Introspector — project site ↗

• FuzzingBrain — project site ↗

• Gemara — project site ↗

• gittuf — project site ↗

• GUAC — project site ↗

• in-toto — project site ↗

• Minder — project site ↗

• OpenSSF Model Signing (OMS) — project site ↗

• OpenBao — project site ↗

• OpenSSF Scorecard — project site ↗

• OSS-CRS — project site ↗

• Package Analysis — project site ↗

• Protobom / SBOM Tools — project site ↗

• Repository Service for TUF (RSTUF) — project site ↗

• SBOMit — project site ↗

• Secure Agentic Framework — project site ↗

• Sigstore — project site ↗

• slsa-github-generator — project site ↗

• slsa-verifier — project site ↗

• Zarf — project site ↗

Publications

• Gemara Whitepaper — read it ↗

• in-toto Attestation — read it ↗

• OSPS Baseline — read it ↗

• OSV Schema & OpenVEX — read it ↗

• OSV Record (vulnerability record format) — read it ↗

• SARIF — read it ↗

• Software Bill of Materials — read it ↗

• Security Insights — read it ↗

• SLSA — read it ↗

• SLSA Provenance — read it ↗

• Vulnerability Exploitability eXchange — read it ↗

How to use this site

Start from whichever axis is most natural:

• Start from a persona → if you know your role.
• Start from a problem → if you know what you’re trying to solve.
• Start from a project → if you already know the project and want to see who it’s for and what it solves.

Every page links across to the other axes, so you can pivot freely.

Data source

The site renders straight from the Jekyll data files in data/ — the vocabularies in data/definitions/ and the per-working-group catalog files in data/working-groups/ — plus a JSON mirror at /assets/data/catalog.json for client-side consumers. Those files are the single source of truth — the usage sentences, problem mappings, Security Insights links, and project relationships all live there and are refined over time.

Contributing

To propose a new project, problem, persona, or mapping, open a pull request on the project repository. Each project should declare the personas and problems it addresses, with one sentence of prose per link.