The scorecard module evaluates open-source projects based on security best practices, providing a score and detailed report on potential risks like binary artifacts, unreviewed code, or dangerous workflows.
When to Activate
- When the user wants to assess the security level of an open-source repository.
- When performing due diligence on a new dependency (npm, PyPI, etc.).
- When auditing a local repository for security improvements.
Core Principles & Rules
- Best Practices: Focuses on identifying risks like lack of CI tests, missing branch protection, or pinned dependencies.
- Detailed Reporting: Use
--show-detailsto understand why specific checks passed or failed.
Patterns & Examples
Repository Audit
# Display the security scorecard for a GitHub repository
x scorecard info github.com/ossf/scorecard
Open Web Report
# Open the full OpenSSF scorecard report in a browser
x scorecard open github.com/owner/repo
Checklist
- Confirm the target repository URL or package name.
- Verify if the user needs a summary or a detailed check breakdown.