OpenSSF Scorecard is a free tool from the Open Source Security Foundation that runs automated checks on a repository's security practices, such as branch protection, code review and dependency updates. A volunteer team can run it in under ten minutes and use the results as a to do list.
What it is
The Scorecard site describes it as a way to quickly assess open source projects for risky practices, with the slogan "build better security habits, one test at a time." It can run two ways: as a GitHub Action on code you own, or from the command line against your own or someone else's project.
It scores habits, not code quality. A project can have clean code and weak habits, such as letting anyone push straight to the main branch.
What it checks
The Scorecard checks documentation lists items such as:
- Branch-Protection
- Code-Review
- Dependency-Update-Tool
- Pinned-Dependencies
- Token-Permissions
- Security-Policy
- Signed-Releases
- Vulnerabilities
- Maintained
- Dangerous-Workflow
The documentation rates Branch-Protection as high risk, since a project without it is vulnerable to intentional malicious code injection. It also notes that some settings need an admin token to be read.
Run it
According to the Scorecard site, the GitHub Action takes under ten minutes to install, requires that you own the repository or have admin rights, and uses a personal access token. The command line route also takes under ten minutes and uses a token with public repo scope. Follow the current instructions on the site rather than copying steps from an old blog.
How a small team can use the results
Do not try to reach a perfect score. Choose the checks that cost little and reduce the most risk.
| Check | Effort | Why it helps |
|---|---|---|
| Security-Policy | Low | Tells reporters how to contact you |
| Branch-Protection | Low | Stops accidental or malicious direct pushes |
| Dependency-Update-Tool | Low | Surfaces outdated libraries |
| Token-Permissions | Medium | Limits what automation can do |
| Code-Review | Depends on team | Needs a second person |
A volunteer project with one maintainer cannot do code review by itself. Do not fake it. Note the gap and decide how to find a second reviewer.
Use it on projects you depend on
The command line lets you check someone else's repository. If your nonprofit relies on a small open source plugin, run Scorecard on it. A low score is not proof of a problem, but it tells you how well the project is looked after. See also corporate dependence on volunteer-maintained projects.
Where Safeguard fits
Scorecard looks at repository habits. Safeguard covers a different layer, SBOM and dependency scanning with reachability analysis, and offers a free scan at gold.safeguard.sh/scan.
A monthly rhythm
Run Scorecard on a schedule, not once. A short monthly look is enough: note which checks changed, fix one cheap item, and record the date. Over a year, small steady changes add up, and they give you a plain record to show contributors and sponsors that the project is looked after.
Quick check
Is a low score a reason to stop using a project?
Not by itself. Treat it as a prompt to look closer at maintenance and open advisories.
Do we need to be experts to run it?
No. The site describes install times under ten minutes. Interpreting results takes judgment, so start with the low effort checks.
Sources
Last reviewed: 19 October 2026.
