Projects are OpenSSF Technical Initiatives that support the innovative delivery of security tooling and best practices to secure critical open source software.

The OpenSSF Technical Advisory Council is responsible for the oversight of the various Technical Initiatives (TI) and maintains a project lifecycle for hosted projects. Interested in hosting a project?

👁 Image

Best Practices Badge

Best practices for Free/Libre and Open Source Software.

Learn More
👁 Image

Bomctl

Bridging the gap between SBOM generation and SBOM analysis tools.

Learn More
👁 Image

Criticality Score

Assigning a score to create a list of critical open source projects.

Learn More
👁 Image

Fuzz introspector

Improving the fuzzing experience of a project.

Learn More
👁 Image

Gemara

A model for the categorical layers of activities related to automated governance.

Learn More
👁 Image

gittuf

Protect the contents of a Git repository from unauthorized or malicious changes.

Learn More
👁 Image

GUAC

Directed, actionable insights into the security of your software supply chain.

Learn More
👁 Image

Minder

Proactively manage security posture by providing a set of checks and policies.

Learn More
👁 Image

OpenBao

Manage, store, and distribute sensitive data including secrets, certificates, and keys

Learn More
👁 Image

OpenSSF Model Signing (OMS)

A library and CLI for signing and verification of ML models.

Learn More
👁 Image

OpenSSF Scorecard

Assess open source projects for security risks through a series of automated checks.

Learn More
👁 Image

OpenVEX

A simplified Vulnerability Exploitability eXchange implementation.

Learn More
👁 Image

OSPS Baseline

Structured security requirements aligned with international frameworks, standards, and regulations.

Learn More
👁 Image

OSS-CRS

A standard orchestration framework for LLM-based bug-finding and bug-fixing systems (Cyber Reasoning Systems)

Learn More
👁 Image

OSV Schema

Better vulnerability triage for open source.

Learn More
👁 Image

Package Analysis

Improving the security of open source software by detecting malicious behavior.

Learn More
👁 Image

Protobom

A format-neutral SBOM data representation and I/O library.

Learn More
👁 Image

Repository Service for TUF

Securing content downloads from tampering between repository and client.

Learn More
👁 Image

SBOMit

Specification of an SBOM format independent method for attesting components.

Learn More
👁 Image

Security Insights

Machine-processable project security information reporting.

Learn More
👁 Image

Sigstore

Sigstore is a standard for signing, verifying, and protecting software.

Learn More
👁 Image

SLSA

Safeguarding artifact integrity across any software supply chain.

Learn More
👁 Image

Zarf

Enable continuous software delivery on systems disconnected from the internet.

Learn More
👁 Image

Best Practices Badge

Best practices for Free/Libre and Open Source Software.

Learn More
👁 Image

Sigstore

Sigstore is a standard for signing, verifying, and protecting software.

Learn More
👁 Image

SLSA

Safeguarding artifact integrity across any software supply chain.

Learn More
👁 Image

gittuf

Protect the contents of a Git repository from unauthorized or malicious changes.

Learn More
👁 Image

GUAC

Directed, actionable insights into the security of your software supply chain.

Learn More
👁 Image

OpenSSF Scorecard

Assess open source projects for security risks through a series of automated checks.

Learn More
👁 Image

OSPS Baseline

Structured security requirements aligned with international frameworks, standards, and regulations.

Learn More
👁 Image

Repository Service for TUF

Securing content downloads from tampering between repository and client.

Learn More
👁 Image

Bomctl

Bridging the gap between SBOM generation and SBOM analysis tools.

Learn More
👁 Image

Gemara

A model for the categorical layers of activities related to automated governance.

Learn More
👁 Image

Minder

Proactively manage security posture by providing a set of checks and policies.

Learn More
👁 Image

OpenBao

Manage, store, and distribute sensitive data including secrets, certificates, and keys

Learn More
👁 Image

OpenSSF Model Signing (OMS)

A library and CLI for signing and verification of ML models.

Learn More
👁 Image

OpenVEX

A simplified Vulnerability Exploitability eXchange implementation.

Learn More
👁 Image

OSS-CRS

A standard orchestration framework for LLM-based bug-finding and bug-fixing systems (Cyber Reasoning Systems)

Learn More
👁 Image

Protobom

A format-neutral SBOM data representation and I/O library.

Learn More
👁 Image

SBOMit

Specification of an SBOM format independent method for attesting components.

Learn More
👁 Image

Security Insights

Machine-processable project security information reporting.

Learn More
👁 Image

Zarf

Enable continuous software delivery on systems disconnected from the internet.

Learn More
👁 Image

Criticality Score

Assigning a score to create a list of critical open source projects.

Learn More
👁 Image

Fuzz introspector

Improving the fuzzing experience of a project.

Learn More
👁 Image

OSV Schema

Better vulnerability triage for open source.

Learn More
👁 Image

Package Analysis

Improving the security of open source software by detecting malicious behavior.

Learn More