You should use the OpenSSF Scorecard
Tags: security, node, opensource
Published: 2023-01-23 20:46:00

---
title: You should use the OpenSSF Scorecard
published: true
description: The OpenSSF Scorecard is a great tool for evaluating the security of your project, and we plan to implement it in Nodejs by 2023.
tags: security, nodejs, opensource
#cover_image: https://blog.ulisesgascon.com/img/diagram-flower.svg
# Use a ratio of 100:42 for best results.
published_at: 2023-01-23 20:46 +0000
canonical_url: https://blog.ulisesgascon.com/openssf-scorecard-in-nodejs
---



As you may know, the Node.js Ecosystem Security Working Group has defined [its priorities for 2023](https://github.com/nodejs/security-wg#current-initiatives). A key initiative for us will be to assess the organization against the best practices available, such as the OpenSSF Scorecard.


## OpenSSF in Node.js

We had a great discussion about the OpenSSF scorecard with the Google Open Source Security Team (GOSST) in the Ecosystem Security Working Group meeting this week.

{% embed https://www.youtube.com/watch?v=qzLZbdHSfZE %}


We began the discussion in [this issue](https://github.com/nodejs/security-wg/issues/851), and here you can find [the meeting notes](https://github.com/nodejs/security-wg/blob/main/meetings/2023-01-19.md):

>- Assessment against best practices (OpenSSF Scorecards ...) [#859](https://github.com/nodejs/security-wg/issues/859)
>- Add OSSF Scorecard [#851](https://github.com/nodejs/security-wg/issues/851)
>- Discussion with GOSST about implementing it on Node.js
>- The Nodejs currently report is located [here](https://deps.dev/project/github/nodejs%2Fnode), also [json version available](https://api.securityscorecards.dev/projects/github.com/nodejs/node)
>- Agreement to update action version tag by hash in GHA, following [this example](https://app.stepsecurity.io/secureworkflow/nodejs/node/coverage-linux.yml/main?enable=pin), lead by GOSST
>- Agreement to add/document the next steps in [this issue](https://github.com/nodejs/security-wg/issues/859) in order to provide a good context for the following PRs and TSC Meetings, lead by GOSST


The current score for Node.js is [6.8 out of 10](https://deps.dev/project/github/nodejs%2Fnode). We will be working to improve this score in the coming months. If you would like to be notified, please subscribe to [the Security Working Group repository](https://github.com/nodejs/security-wg/).


## OpenSSF Scorecard in a nutshell

The Scorecard will evaluate the security of your project based on automated checks related to four scenarios.
- Malicious maintainers 
- Build System Compromises
- Source Code Compromises
- Malicious packages


In order to accomplish this, the scripts are focused in 5 areas (Code Vulnerabilities, Maintenance, Continuous Testing, Source Risk Assestment, Build Risk Assestment and Holistic Security Practices). 

![Diagram flower that includes the 5 areas with the Holistic Security Practices in the middle](https://blog.ulisesgascon.com/img/diagram-flower.svg)

Each area has its own associated risk, so the overall score is the average of the five areas. [Here](https://github.com/ossf/scorecard/blob/main/docs/checks.md), you can check the details of each by consulting the documentation in detail.


The following are the types of questions this score card provides answers to:
- Does the project contain a security policy?
- Does the project use fuzzing tools?
- Does the project use static code analysis tools?
- Does the project use Branch Protection?
- Does the project have contributors from at least two different organizations?
- Does the project cryptographically sign releases?
- And many more...

If you are wondering if this is a good idea for your project, I think it is a good idea to at least review your packages in [the directory](https://deps.dev/).


## OpenSSF Scorecard Implementation


> It took less than 5 minutes to install. It quickly analysed the repo and identified easy ways to make the project more secure. Priya Wadhwa, [Kaniko](https://github.com/GoogleContainerTools/kaniko)


You have two options:
- [Using the GitHub Action](https://securityscorecards.dev/#using-the-github-action)
- [Using the CLI](https://securityscorecards.dev/#using-the-cli)

-------------

👉 This blog post was originally posted in [my blog](https://blog.ulisesgascon.com/openssf-scorecard-in-nodejs) the 22/01/2023