The safeguards map / 1.1 Code and dependencies
OpenSSF Scorecard
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
An automated tool that scores an open source project from 0 to 10 on a set of security checks, run from a command line or as a GitHub Action.
Where it sits
1.1 Code and dependencies (primary): Assesses a repository against a set of security checks and assigns each check a score from 0 to 10, so maintainers and dependency consumers can judge its security practices.
Scorecard is an automated tool that assesses a number of important heuristics
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who run it
- Runs
- by handin CI
Handoffs
produces Findings: SARIF (through the Scorecard GitHub Action)
Collector's note
The main repository README lists text and JSON output; the Static Analysis Results Interchange Format (SARIF) output belongs to the project's separate GitHub Action repository.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.