---
title: "Discussion on \"OpenSSF Scorecard explained: catching risk in packages that don't have a CVE yet\" | Hashnode"
description: "Discussion on \"OpenSSF Scorecard explained: catching risk in packages that don't have a CVE yet\". Most dependency scanners only tell you about vulnerabilities that already have an advisory filed against them. That's useful, but it's inherently reactive — it only catches risk after someone has foun"
url: "https://hashnode.com/posts/openssf-scorecard-explained-supply-chain-security-risk/6abd3e5e6a575d5abb4ef848"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [OpenSSF Scorecard explained: catching risk in packages that don't have a CVE yet](https://depwarden.hashnode.dev/openssf-scorecard-explained-supply-chain-security-risk?utm_source=hashnode&utm_medium=feed)

Most dependency scanners only tell you about vulnerabilities that already have an advisory filed against them. That's useful, but it's inherently reactive — it only catches risk after someone has foun

Sep 30 · 4 min read · depwarden.hashnode.dev  
Read the article

-   [#opensource](https://hashnode.com/tag/opensource)
-   [#security](https://hashnode.com/tag/security)
-   [#devsecops](https://hashnode.com/tag/devsecops)
-   [#github](https://hashnode.com/tag/github)

## Written by

[Rushabh Shah](https://hashnode.com/@rushabh5000)

@rushabh5000 · Mumbai, India

  
[View profile](https://hashnode.com/@rushabh5000)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.