Security scorecards for open source projects

Re:Security scorecards for open source projects by ssddanbrown on Monday November 09, 2020 @07:03PM (#25041446)

Received these results for my own open source project:

    ./scorecard --repo=github.com/bookstackapp/bookstack
    <removed status text>
    RESULTS
    -------
    Active: Pass 10
    CI-Tests: Pass 8
    CII-Best-Practices: Fail 10
    Code-Review: Fail 10
    Contributors: Pass 10
    Frozen-Deps: Pass 10
    Fuzzing: Fail 3
    Pull-Requests: Pass 7
    SAST: Fail 0
    Security-Policy: Fail 10
    Signed-Releases: Fail 0
    Signed-Tags: Pass 10

Results appear fair and accurate. I am confused though in how this project is intended to work at a higher level. The blogpost states:

> The goal of the Scorecards project is to auto-generate a “security score” for open source projects to help users as they decide the trust, risk, and security posture for their use case.

Will there be a centralised site to gather and display scores for open source projects? Or will it be up to the open source projects themselves to integrate this into their pages and, if so, what does that look like? Some kind of badge or a listing of the results as above? Just trying to understand how end-users will be interpreting the results in a consistent and trusted manner.

[ Parent | on HN ]

Re:Security scorecards for open source projects by abharya on Monday November 09, 2020 @10:29PM (#25042577)

We are still thinking of ways to capture scores for various open source projects in an automated fashion and/or work with GitHub to display this kind of information as part of their user interface. Right now, project maintainers need to run it themselves.

[ Parent | on HN ]