Скачать или смотреть Security Insights: Machine-Readable Security Metadata for Open Source | OpenSSF Project Spotlight

Security Insights is a specification from the OpenSSF designed to help open source projects express key security-related facts about their repositories in a machine-readable format. These are details that typically live in a README or SECURITY.md, but cannot be reliably inferred through automated scans.

The specification is supported by a Go library that enables projects to ingest Security Insights files, scan repositories automatically, and surface this data in downstream evaluations. This includes use cases like checking compliance with the OpenSSF Open Source Project Security (OSPS) Baseline and integrating results into platforms such as the LFX Insights dashboard.

By shifting important security information into a structured, machine-readable format, Security Insights enables consistent, automated analysis across the broader ecosystem.

This video features insights from Security Insights maintainer:
• Eddie Knight, OSPO Technical Program Manager at Sonatype