OpenSSF Scorecard explained: catching risk in packages that don't have a CVE yet

Most dependency scanners only tell you about vulnerabilities that already have an advisory filed against them. That's useful, but it's inherently reactive — it only catches risk after someone has found and disclosed it. OpenSSF Scorecard takes a different angle: instead of asking "has this package been proven vulnerable," it asks "does this... Weiterlesen