The OpenSSF Best Practices Badge is a free, self-certified questionnaire a project fills in to show it follows recommended practices. Scorecard is an automated tool that scans a repository and scores checks. They are separate programs, linked by one Scorecard check that reads whether a project holds the badge.
The badge
The badge program originated as the Core Infrastructure Initiative Best Practices badge and is now part of the OpenSSF Best Practices Working Group. According to the program site, projects can voluntarily self-certify at no cost using its web application. They explain how they meet each practice, and automated analysis fills in many answers and flags obviously incorrect ones.
The criteria for the passing badge are linked from the site. Scorecard's documentation also mentions silver and gold levels. I could not confirm the requirements for those levels from the pages I read, so check the program site before quoting them.
Scorecard
Scorecard is run by the same foundation but works differently. It collects data from the repository and its hosting platform and returns a 0 to 10 score per check, weighted by risk into an aggregate. Nobody fills in a form. The results can differ from what a project would claim about itself.
Side by side
| Best Practices Badge | Scorecard | |
|---|---|---|
| Method | Self-certification with automated hints | Automated checks |
| Output | A badge level | Scores from 0 to 10 per check |
| Effort for maintainers | Fill in a questionnaire | None, unless they act on results |
| Strength | Covers practices not visible in a repo | Objective and repeatable |
| Weakness | Rests on honest answers | Heuristics with false positives |
How they connect
Scorecard has a CII-Best-Practices check, rated Low risk. Per the documentation, it scores a project by badge level: gold is 10, silver 7, passing 5, and in progress 2. The remediation is to sign up for the badge program. Because the check has Low weight, it moves the aggregate only slightly.
Which should you rely on
For picking dependencies, use both as hints and trust neither alone. A badge shows that maintainers thought about practices and took time to document them. A Scorecard result shows what the repository looks like right now. Neither tells you whether a specific version contains a vulnerability, so keep a dependency scanner in the loop.
If you maintain a project, the badge is a free way to work through a checklist, and many of its answers will improve your Scorecard results too.
Quick check
Is the badge a certification?
It is a self-certification. The program site says projects can voluntarily self-certify at no cost.
Sources
Last reviewed: 19 October 2026.
