The Best Practices for OSS Developers working group is an educational initiative that provides security guidance and resources for open source developers.
The working group addresses the need for accessible security knowledge in open source development by curating and promoting best practices tailored to different technologies, languages, and frameworks. Its approach centers on three core activities: helping developers identify good practices and tools, providing learning resources suited to different learning styles, and offering tooling that integrates security practices into daily workflows. The group collaborates with security experts to develop comprehensive guidance and works to identify gaps where new tools or resources could support secure development adoption.
The working group operates as a community-driven effort within the OpenSSF, welcoming participation in open discussions. It maintains an inventory of best practices prioritized by return on investment for open source developers and organized by technology domain. The group's strategy emphasizes collaboration across the broader OpenSSF ecosystem and engagement with open source maintainers to drive adoption of its artifacts, which include guides, training materials, and tools. This approach suits organizations and individual developers seeking to understand security best practices relevant to their specific technology stack and looking for structured, community-vetted guidance rather than scattered resources.
The project maintains active engagement with the broader open source security community through collaboration with other OpenSSF working groups and initiatives. Development activity centers on expanding the inventory of practices, identifying resource gaps, and creating or promoting tools that enable practical adoption of security recommendations. The working group operates transparently with public discussions and documented roadmaps, reflecting its mission to democratize access to security knowledge across the open source ecosystem.
