OSPS Baseline
The OpenSSF Open Source Project Security Baseline: a minimum set of security controls for an open-source project in three maturity levels, covering access control, build and release, documentation, governance, legal, quality, security assessment and vulnerability management. The OpenSSF Security Baseline SIG maintains it; the current version is v2026.08.28.
- Also called
- Open Source Project Security Baseline
Covered in
Protect the source repository: rulesets, reviews and signed commits
Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.
Meet the OpenSSF OSPS Baseline as a maintainer: the levels, every Level 1 control on GitHub, and the evidence
Walk through the eight control families and three maturity levels of OSPS Baseline v2026.08.28, meet each Level 1 requirement on a GitHub repository, and keep evidence a consumer can check.