Repository files navigation

The OpenSSF Scorecard Monitor Visualizer is a tool that provides a visual representation of the OpenSSF Scorecard data for monitoring the security status of open source projects. It fetches the scorecard data from theOpenSSF Scorecard API and presents it in a user-friendly and interactive visual format.

The Visualizer is part of theOpenSSF Scorecard Monitor, where you can access to the features.

Display the OpenSSF Scorecard data in a visual format for easy understanding and analysis.

Compare between two commits that reported Scorecard data. See how the scores changed and further details.

Makes easier the visualization of the differences in the Scorecard comparator reasoning and details.

The project provides support of visualization and diff comparation for GitLab projects. In the GitLab version, deps.dev and step security links are not included, as those platforms don't support GitLab projects yet.

The Scorecard API can provide discrepancies in the data while comparing between two commits duetechnical reasons. The visualizer provides a way to showcase the discrepancies found.

The Visualizer and the Comparator can be used outside the Monitor.

You have 3 options of visualization. Depending on which one you want to check, you should craft your own url as:

• Checks the latest Scorecard data available for a project:https://ossf.github.io/scorecard-visualizer/#/projects/${platform}/${org}/${repo}
• Checks the Scorecard data for an specific commit (previously reported):https://ossf.github.io/scorecard-visualizer/#/projects/${platform}/${org}/${repo}/commit/{commitHash}
• Compares two specific commits, previously reported:https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node/compare/{prevCommitHash}/{currentCommitHash}

👉 Please note that in order to retrieve data from the Scorecard API, it is necessary for organizations or repository owners to report their commits to the Scorecard. However, it's important to keep in mind that not all organizations report their commits, which may result in a404 error if the data is not available in the API. Please be aware that this behavior is expected and not indicative of a bug.

• Nodejs latest repository Scorecard
• Nodejs specific commit Scorecard
• Nodejs reported commits comparation

Contributions are welcome! If you would like to contribute to the OpenSSF Scorecard Monitor Visualizer project, please follow these steps:

1. Fork the repository.
2. Create a new branch for your feature or bug fix.
3. Make your changes and ensure that the code is properly formatted.
4. Write tests to cover your changes if applicable.
5. Commit your changes and push them to your forked repository.
6. Submit a pull request to the main repository, explaining your changes and providing any relevant details.

This project is licensed under theApache License Version 2.0.

If you encounter any issues or have questions about the OpenSSF Scorecard Monitor Visualizer, pleaseopen an issue on the GitHub repository.