Issues

• Feature: Rule that promotes lock files over sha pinning

  kind/enhancement
  ossf/scorecard#5346 · Filter by author jessehouwing opened on Oct 18, 2026

• BUG: rate limit transport sleeps past the context deadline

  ossf/scorecard#5345 · Filter by author jessehouwing opened on Oct 18, 2026

• BUG: path handling and file handle bugs surfaced by running tests on Windows

  ossf/scorecard#5344 · Filter by author jessehouwing opened on Oct 18, 2026
  1

• Detect pre-commit framework for SAST score

  kind/enhancement
  ossf/scorecard#5333 · Filter by author peterfpeterson opened on Oct 16, 2026

• Current-behavior quirks recorded by the OpenSpec baseline

  kind/bug
  ossf/scorecard#5328 · Filter by author justaugustus opened on Oct 15, 2026
  

• BUG: "curl" is an OSI approved license

  kind/bug
  ossf/scorecard#5327 · Filter by author bagder opened on Oct 14, 2026 · v5.7.0
  1

  

• BUG: ossf/scorecard-action flagging valid cache-mode: none key in scorecard workflow

  kind/bug
  ossf/scorecard#5322 · Filter by author vszakats opened on Oct 13, 2026 · v5.7.0
  2

  

• Score discrepancy between --repo and --local on same repository

  kind/bug
  ossf/scorecard#5321 · Filter by author huornlmj opened on Oct 13, 2026
  1

• BUG: the proposed scorecard action fails zizmor and yamlchecks

  kind/bug
  ossf/scorecard#5320 · Filter by author bagder opened on Oct 13, 2026 · v5.7.0
  5

  

• Enhancement of maintained check to better indicate abandoned repositories

  kind/enhancement
  ossf/scorecard#5315 · Filter by author FelixOliverLange opened on Oct 12, 2026
  2

• BUG: Pinned-Dependencies doesn't handle Dockerfile syntax directive

  kind/bug
  ossf/scorecard#5314 · Filter by author jamietanna opened on Oct 12, 2026
  1

• Release process follow-ups from v5.6.0

  kind/enhancement
  ossf/scorecard#5312 · Filter by author justaugustus opened on Oct 11, 2026 · v5.7.0
  1

  

• Feature: generate release provenance with GitHub artifact attestations instead of slsa-github-generator

  kind/enhancement
  ossf/scorecard#5308 · Filter by author justaugustus opened on Oct 11, 2026 · v5.7.0
  1

  

• Pinned-Dependencies skips GitHub Actions referenced through YAML aliases

  kind/bug
  ossf/scorecard#5291 · Filter by author justaugustus opened on Oct 5, 2026 · v5.7.0
  3

  

• Feature: Packaging check should detect Helm chart publishing workflows

  kind/enhancement
  ossf/scorecard#5288 · Filter by author purisev opened on Oct 4, 2026

• Branch-Protection: recognize the cncf/prow-github-actions review gate (/lgtm + /approve) as a review requirement

  kind/enhancement
  ossf/scorecard#5280 · Filter by author mfahlandt opened on Oct 1, 2026
  2

  

• Feature request: Support Codeberg

  kind/enhancement
  ossf/scorecard#5279 · Filter by author marek22k opened on Oct 1, 2026

• make install fails during onboarding and CI does not propagate the failure

  kind/bug
  ossf/scorecard#5251 · Filter by author Walentalien opened on Sep 26, 2026

• Do you consider Mutation testing alongside Coverage and Fuzzing?

  kind/question
  ossf/scorecard#5242 · Filter by author AlanGraham opened on Sep 16, 2026
  2

• BUG: unconditional ListCommits makes Scorecard unusable with a GitHub App installation token

  kind/bug
  ossf/scorecard#5214 · Filter by author corbin-infonetica opened on Sep 3, 2026
  2

• [IMPORTANT] Scorecard Infrastructure Changes

  area/community
  ossf/scorecard#5208 · Filter by author justaugustus opened on Aug 30, 2026
  9

  

• PinnedDependenciesID should recognize GitHub actions.lock enforcement

  needs triage
  ossf/scorecard#5207 · Filter by author hyperpolymath opened on Aug 29, 2026
  2

• BUG: Code-Review treats any merged PR with an approved/lgtm label as reviewed, ignoring the PR's actual reviews

  needs triage
  ossf/scorecard#5206 · Filter by author mapyr opened on Aug 29, 2026
  2

• Packaging check does not recognize GitHub CLI and Nextcloud App Store publishing workflows

  needs triage
  ossf/scorecard#5201 · Filter by author Dennis-Otto opened on Aug 27, 2026

• BUG: Security-Policy scores the contents of an unrelated security.md found elsewhere in the tree

  needs triage
  ossf/scorecard#5198 · Filter by author tufantunc opened on Aug 25, 2026
  2