> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/administration/compliance-automation/openssf-scorecard.md).

# OpenSSF ScoreCard

### What is OpenSSF 

Open Source Security Foundation (OpenSSF) is an industry collaboration focused on improving the security of open-source software. The OpenSSF aims to bring together various stakeholders to address security challenges in open-source software and to create resources and initiatives that enhance the overall security posture of the open-source ecosystem.

This framework, when integrated in Delivery Shield, gets converted to code format. The policies created based on this framework prompts an alert or prevents the deployment if the rule fails. 

### Example of OpenSSF policies in Delivery Shield

* **Open SSF Binary Artifacts Policy** - This check determines whether the project has generated executable (binary) artifacts in the source repository.
* **Open SSF CI Tests Policy** - This assesses if the project enforces running tests before merging pull requests, currently applicable only to GitHub-hosted repositories, excluding other source hosting platforms.
* **Open SSF Packaging Policy** - This assesses if the project is released as a package, but only works for GitHub repositories, excluding other source hosting platforms.
* **Open SSF Signed Releases Policy** - This determines if the project cryptographically signs release artefacts.
* **Open SSF Token Permissions Policy** - This Determines Whether the project automated workflow tokens follow the principle of least privilege. 

Refer [OpenSSF](https://openssf.org/about/) for more information.