Best Practices Badge for Free/Libre and Open Source Software | OpenSSF Project Spotlight

Why It Matters

The badge gives both developers and enterprises a transparent, verifiable signal of open‑source security hygiene, helping to lower supply‑chain risk and drive broader adoption of best‑practice controls.

Key Takeaways

• Best Practices Badge defines three security levels for OSS projects
• Self‑certification is aided by automation, public answers, and spot checks
• Badge differs from Scorecard’s full automation and Baseline’s minimal criteria
• Over 9,000 projects enrolled; ~2,000 have earned at least silver
• Projects can improve security and signal trust by earning the badge

Summary

David Wheeler, director of open‑source supply‑chain security at the OpenSSF, introduced the OpenSSF Best Practices Badge – a three‑tier (passing, silver, gold) certification that evaluates open‑source projects against a curated set of security‑focused criteria drawn from well‑run repositories. The badge is awarded through a web‑based self‑assessment tool that combines automated checks, public answer displays, and spot‑check overrides to mitigate typical self‑certification risks.

The badge’s criteria are designed to surface blind spots; projects often discover missing practices on first review and can remediate them to improve security posture. Unlike the fully automated OpenSSF Scorecard, which may produce false positives/negatives but scales to thousands of projects, the Best Practices Badge allows nuanced, project‑specific responses. It also complements the newer OpenSSF Baseline, which offers a smaller set of mandatory controls, and the badge roadmap includes integrating those baseline criteria.

As of November 2025, more than 9,000 projects have signed up on dubdubdub.bestpractices.dev, with nearly 2,000 earning at least a passing badge. High‑profile adopters include the Linux kernel, Kubernetes, Node.js, LibreOffice, cURL, Nextcloud and Blender, showcasing the badge’s growing credibility among critical infrastructure.

For maintainers, earning the badge signals a commitment to security, helps attract contributors and users, and provides a tangible metric for risk‑aware procurement. For enterprises, the badge offers a quick, trustworthy indicator when evaluating third‑party open‑source components, potentially reducing supply‑chain risk.

Original Description

The OpenSSF Best Practices Badge is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow best practices. Projects can voluntarily self-certify, at no cost, by using this web application to explain how they follow each best practice. The OpenSSF Best Practices Badge is inspired by the many badges available to projects on GitHub. Consumers of the badge can quickly assess which FLOSS projects are following best practices and, as a result, are more likely to produce higher-quality secure software.

The OpenSSF Best Practices Badge website outlines the criteria for the passing badge, provides an example, shows participating projects, and supports queries to show projects that have a passing badge. This project was formerly known as the Core Infrastructure Initiative (CII) Best Practices Badge and was formally renamed as part of OpenSSF in late 2021.

Learn more at www.bestpractices.dev

This video features insights from Best Practices maintainer:

• David A. Wheeler, Director of Open Source Supply Chain Security at OpenSSF