OpenSSF Scorecard: On the Path Toward Ecosystem-Wide Automated Security Metrics
Nusrat Zahan, Parth Kanakiya, Brian Hambleton, Shohanuzzaman Shohan, Laurie Williams
Abstract
The OpenSSF Scorecard project is an automated tool to monitor the security health of open source software. This study evaluates the applicability of the Scorecard tool and compares the security practices and gaps in the npm and PyPI ecosystems.
Topics & Concepts
Balanced scorecardPath (computing)Computer scienceEcosystemEnvironmental resource managementBusinessProcess managementEnvironmental scienceEcologyComputer networkBiologyOpen Source Software InnovationsScientific Computing and Data ManagementSoftware Engineering Research