Microproduct data guideintermediate

OpenSSF Scorecard

Automated security-practice scores for public repositories for building dependency-acceptance checks and maintainer-risk reviews.

Start the guide Open official source

At a glance

Difficulty
Intermediate — some data preparation helps
Size
Tiny · ≤0.01 GB
Formats
JSON
Access
API
API key
Not required
Provider
Open Source Security Foundation
Updates
Continuous
Data terms
Community Data License Agreement Permissive 2.0

From source to product signal

Test a product idea in four steps

OpenSSF Scorecard publishes precomputed checks for public GitHub projects. Start with one well-known repository and read the aggregate score plus a few high-risk checks. Scores describe repository practices, not whether a specific package version is vulnerable.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Read the Scorecard project page and the CDLA Permissive 2.0 data licence.
  2. 2.Request the published score for github.com/ossf/scorecard.
  3. 3.Keep the date, aggregate score, and check names before comparing projects.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

import pandas as pd
import requests

response = requests.get(
    "https://api.scorecard.dev/projects/github.com/ossf/scorecard",
    timeout=30,
)
response.raise_for_status()
payload = response.json()
checks = pd.json_normalize(payload.get("checks", []))
checks["repo"] = payload.get("repo", {}).get("name")
checks["score"] = payload.get("score")
print(payload.get("repo"), payload.get("score"))
print(checks[["name", "score", "reason"]].head(10))
4

Test a useful signal

Review one repository's Scorecard checks

Decide whether Scorecard can support an accept-or-review rule for a new dependency.

  1. 01Store the aggregate score and the Dangerous-Workflow, Branch-Protection, and Maintained checks.
  2. 02Flag any check scored below 5 and record the published reason text.
  3. 03State that Scorecard does not replace CVE monitoring or a review of the exact package version you would install.

Dataset details

Open Source Security Foundation is a nonprofit source. Last verified 2026-08-18. Temporal coverage: continuously rescored public repositories.

Theme

Technology & Cybersecurity

Domains

Software SecurityOpen SourceCybersecurity

Data types

ScoresRepository Metadata

Tasks

Risk AssessmentDependency ReviewSecurity Monitoring

Geography

Global

Formats

JSON

Provider

Open Source Security Foundation

Data terms

Community Data License Agreement Permissive 2.0