OpenSSF Best Practices Projects

Scrapes public OpenSSF (formerly CII) Best Practices Badge project records — badge tier, license, repo/homepage links, and selected security-practice criterion statuses — from bestpractices.dev. Useful for open-source supply-chain risk screening, dependency/vendor-risk enrichment, and OSS security posture monitoring.

Use cases

• Dependency risk screening — check whether an open-source dependency has earned an OpenSSF Best Practices badge and at what tier (passing/silver/gold) before adopting it.
• Vendor/procurement risk enrichment — normalize badge data into a vendor-risk or SBOM pipeline alongside other supply-chain signals.
• OSS security posture monitoring — track badge tier changes and specific criterion statuses (HTTPS, license, vulnerability reporting, crypto practices) for a watchlist of projects over time.

Input

Field	Type	Description
startUrls	array	Listing pages (https://www.bestpractices.dev/en/projects.json?page=N) to discover project IDs from
maxItems	integer	Maximum number of project detail records to output (default 100)
delaySeconds	number	Polite delay before each request (default 1.0)
concurrency	integer	Bounded concurrent detail-page fetches (default 5)

Output fields

Field	Type	Description
project_id	integer	Numeric project ID
project_name	string	Project name
description	string	Project description
project_detail_url	string	Project detail page URL
homepage_url	string	Project homepage URL
repo_url	string	Source repository URL
license	string	Project's declared license
badge_level	string	passing / silver / gold / in_progress
tiered_percentage	integer	Badge tier percentage
last_updated_at	string	Last-updated timestamp from the project record
sites_https_status	string	Criterion: site/repo HTTPS status
floss_license_status	string	Criterion: FLOSS license status
floss_license_justification	string	Criterion: FLOSS license justification
vulnerability_report_process_status	string	Criterion: vulnerability reporting process status
crypto_published_status	string	Criterion: published crypto practices status
scrape_timestamp	string	ISO timestamp when this record was scraped

Example output

{
  "project_id": 1,
  "project_detail_url": "https://www.bestpractices.dev/en/projects/1",
  "scrape_timestamp": "2026-08-04T00:14:51.520447+00:00",
  "project_name": "BadgeApp",
  "description": "BadgeApp is the web application that allows developers to provide information about their project and (hopefully) get an Open Source Security Foundation (OpenSSF) Best Practices badge...",
  "homepage_url": "https://github.com/ossf/best-practices-badge",
  "repo_url": "https://github.com/ossf/best-practices-badge",
  "license": "MIT",
  "badge_level": "gold",
  "tiered_percentage": 300,
  "last_updated_at": "2026-07-18T04:02:54.845Z",
  "sites_https_status": "Met",
  "floss_license_status": "Met",
  "floss_license_justification": "The MIT license is widely acknowledged as being OSS...",
  "vulnerability_report_process_status": "Met",
  "crypto_published_status": "Met"
}

Pricing

$5 per 1,000 results.

Results	Estimated cost
100	$0.50
500	$2.50
1,000	$5.00
5,000	$25.00

Notes

Respects robots.txt — only crawls /en/projects.json, /en/projects/<id>.json, and the English/no-locale project listing/detail pages; never crawls /users pages or sort/query-filtered listing variants, per the target's own privacy-oriented robots directives. No login required — all data is public.