Problems

The 8 problem areas the OpenSSF toolchain addresses. Pick one to see which projects help with it — and which personas care most.

Prefer to start elsewhere? Browse by role → or by project →

Build & Provenance Integrity

Build Integrity

Ensuring artefacts are built from the expected source, on a trusted platform, without tampering — and that the resulting provenance is verifiable by anyone downstream.

See the projects that help

Artefact Signing & Verification

Signing

Proving who produced an artefact and confirming it has not been altered in transit, ideally without the burden of managing long-lived signing keys.

See the projects that help

Dependency & SBOM Visibility

Visibility

Knowing exactly what components ship inside your software — direct and transitive — and being able to query that inventory when something changes.

See the projects that help

Vulnerability Management

Vulnerabilities

Tracking which known vulnerabilities affect your software, sharing machine-readable exploitability status, and cutting through false positives.

See the projects that help

Secure Repository Configuration

Configuration

Keeping source repositories configured to a safe baseline — branch protection, required reviews, hardened settings — and stopping drift before it becomes an entry point.

See the projects that help

Measuring Security Posture

Posture

Quantifying how healthy and well-maintained a project is, so maintainers, consumers, and registries can compare projects and prioritise attention.

See the projects that help

Policy & Compliance Enforcement

Compliance

Defining a consistent set of security expectations and automatically enforcing them across many projects — and producing evidence for auditors and regulators.

See the projects that help

Secrets Management

Secrets

Storing, rotating, and brokering access to credentials and signing keys so they never end up hardcoded in source or leaked through a pipeline.

See the projects that help