---
id: supply-chain-posture-openssf-scorecard
board: code
section: health
status: shipped
category: Security · Posture
complexity: S
impact: Med
wow: 4
note: badge-worthy
order: 3
owner: loop/scorecard
pr: 193
title: Supply-chain posture — OpenSSF Scorecard
---
The Scorecard GitHub Action audits ~18 supply-chain signals weekly —
           branch protection, token permissions, SHA-pinned actions, dangerous
           workflows, signed releases — and publishes results to the Security tab
           plus a README badge. Turns <em>"are we set up safely?"</em> into a
           tracked, trend-able number for a repo that owns a Trusted-Publisher
           release path.
