Measuring Security Posture
Quantifying how healthy and well-maintained a project is, so maintainers, consumers, and registries can compare projects and prioritise attention.
6 OpenSSF projects and publications help with Posture, each with a one-sentence note on how. Prefer another way in? Browse by role →
Best Practices Badge
Turns adherence to recognised practices into a single, comparable trust signal that consumers can read at a glance.
Full breakdown
Criticality Score
Scores how critical a project is to the wider ecosystem so attention and investment can be prioritised where it matters most.
Full breakdown
Gemara
Standardizes how risk and control evidence are expressed so posture can be assessed automatically and compared across projects.
Full breakdown
OpenSSF Scorecard
Runs automated health checks against a project and produces a single comparable score consumers can act on.
Full breakdown
OSPS Baseline
Defines the floor of expected security practices so projects can be measured against a shared bar.
Full breakdown
Security Insights
Lets a project self-declare its security posture in a machine-readable file that consumers can aggregate and compare.
Full breakdown