Software Developer / Maintainer
You write and maintain the software. You need tools that shift security left — into local builds, pull-request checks, and everyday release hygiene — without slowing you down.
Here are the 17 OpenSSF projects and publications that address the Developer persona, each with a one-sentence action written for the role. Prefer another way in? Browse by problem →
Best Practices Badge
Achieves the Best Practices Badge to voluntarily self-certify and demonstrate their adherence to secure development standards.
Full breakdown
Bomctl
Fetches and merges the SBOMs for their project's dependencies into a single document they can inspect and hand downstream.
Full breakdown
Criticality Score
Evaluates the criticality score of their own project to understand its ecosystem impact and secure necessary maintenance support.
Full breakdown
gittuf
Protects their repository with signed, platform-independent rules governing who can change which branches and tags.
Full breakdown
GUAC
Queries GUAC to understand the exact dependency graph and vulnerability blast radius for the components they are actively developing.
Full breakdown
Minder
Uses Minder to proactively manage their security posture and attest secure practices to downstream consumers.
Full breakdown
OpenSSF Model Signing (OMS)
Signs the ML models they publish so downstream users can confirm a model came from them and has not been altered.
Full breakdown
OpenBao
Uses OpenBao APIs to securely fetch database credentials and API keys without hardcoding them into source code.
Full breakdown
OpenSSF Scorecard
Leverages the OpenSSF Scorecard to identify and implement the security practices required for commercial downstream adoption.
Full breakdown
Protobom / SBOM Tools
Integrates SBOM generation tools into their local build process to automatically document the components used in their software.
Full breakdown
Repository Service for TUF (RSTUF)
Relies on RSTUF-backed repositories to confidently pull dependencies without fear of targeted man-in-the-middle or rollback attacks.
Full breakdown
SBOMit
Generates an SBOM whose entries are backed by signed attestations of how each component was actually built.
Full breakdown
Sigstore
Adopts Sigstore to cryptographically sign artifacts and ensure their integrity early in the release process.
Full breakdown
OSPS Baseline
Adopts the OSPS Baseline to implement fundamental security steps, like secure workflows and disclosure policies, early in development.
Full breakdown
OSV Schema & OpenVEX
Generates OpenVEX documents to explicitly inform users that their project is not affected by a specific vulnerability found in a dependency.
Full breakdown
Security Insights
Creates a Security Insights file to report their project's security information in a machine-processable way.
Full breakdown
SLSA
Follows SLSA guidelines to implement secure coding and build practices that prevent tampering with their source code.
Full breakdown