OpenSSF Best Practices Badge Program

[aschaeffer]

OpenSSF Best Practices Badge Program

About

The Open Source Security Foundation (OpenSSF) Best Practices badge is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow best practices. Projects can voluntarily self-certify, at no cost, by using this web application to explain how they follow each best practice. The OpenSSF Best Practices Badge is inspired by the many badges available to projects on GitHub. Consumers of the badge can quickly assess which FLOSS projects are following best practices and as a result are more likely to produce higher-quality secure software.

https://www.bestpractices.dev/en

Criteria

Basics

• Basic project website content #2
• FLOSS license #3
• Documentation #4
• Other #5

Change Control

• Public version-controlled source repository #6
• Unique version numbering #7
• Release notes #8

Reporting

• Bug-reporting process #9
• Vulnerability report process #10

Quality

• Working build system #11
• Automated test suite #12
• New functionality testing #13
• Warning flags #14

Security

• Secure development knowledge #15
• Use basic good cryptographic practices #16
• Secured delivery against man-in-the-middle (MITM) attacks #17
• Publicly known vulnerabilities fixed #18
• Other security issues #19

Analysis

• Static code analysis #20
• Dynamic code analysis #21