The OpenSSF Best Practices Badge is self-certified by the project. Scorecard is an automated, weighted heuristic score. The OSPS Baseline is a set of controls a project can be measured against. All three are signals about project hygiene. None is an audit or a guarantee that the code is safe.
The Best Practices Badge
The badge page says it lets free and open source projects show they follow best practices. It was formerly the CII Best Practices badge and was renamed on 2021-12-24. Projects voluntarily self-certify, at no cost, by explaining how they follow each practice. Automated analysis fills in many answers and blocks obviously incorrect ones. The page mentions no independent third party verification.
Read a badge as a project's own statement, with some automated sanity checking.
Scorecard
The Scorecard documentation says each check scores from 0 to 10, and the aggregate is a weighted average. Checks are weighted by risk level: Critical 10, High 7.5, Medium 5 and Low 2.5. Dangerous-Workflow is rated Critical, while checks such as Branch-Protection, Code-Review, Maintained, Signed-Releases and Vulnerabilities are High. One low weight check looks at whether the project has the Best Practices badge.
The documentation is candid about limits. The checks are heuristics that can give false positives and false negatives. Scorecard is opinionated and does not claim to be a definitive standard. An aggregate score hides which practices a repository follows, and the documentation suggests reading individual checks. Scores can shift as heuristics change.
The OSPS Baseline
The Open Source Project Security Baseline is maintained by the OpenSSF Security Baseline SIG. It is a set of controls, organized by maturity level and category, that projects should meet to show a strong security posture. The page describes the controls as MUST requirements only, with no SHOULDs, and says the current version is v2026.08.28. Downstream consumers are told to state compliance against a specific version.
How they fit together
- Badge: what the project says it does.
- Scorecard: what an automated tool can observe from the repository.
- Baseline: what a defined set of controls expects.
Using them in a decision
Do not average them. Use them as questions. If a project has no badge, ask why. If Scorecard shows low Code-Review, look at how changes are actually approved. If you need a defensible checklist for an internal policy, the Baseline gives you versioned controls to cite.
Then add things none of them measure: how fast security reports get answered, and whether the project has more than one maintainer. For a longer checklist, see evaluating an open source project step by step.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning plus policies and gates, so you can set your own rules for the dependencies you allow. A free scan is at gold.safeguard.sh/scan.
Quick check
Does a badge mean someone audited the project?
No. The badge page describes voluntary self-certification with no mention of independent verification.
Is a Scorecard number a standard?
No. The documentation says it is opinionated and not a definitive standard.
Sources
Last reviewed: 19 October 2026.
