zanadir and OpenSSF Scorecard
Both are open-source tools for repository and CI/CD security, and they answer different questions. Scorecard rates a project's security practices. zanadir reads the CI pipeline and grades whether the security checks it runs can actually fail the build. Most projects benefit from both.
| OpenSSF Scorecard | zanadir | |
|---|---|---|
| Question | Does this project follow good security practices? | Does this pipeline block a bad change, and what is it missing? |
| Reads | The forge's API and the repository: branch protection, reviews, releases, workflows | The CI configuration, followed into Makefiles, scripts, package.json scripts, reusable workflows and templates |
| Security tools | Checks for SAST through known apps such as CodeQL or SonarCloud, and for Dependabot or Renovate | More than 130 tools across 13 categories: dependency, secret and code scanning, IaC, SBOM and signing, workflow security, linting, tests and more |
| Can the check fail? | Records that a tool is present | Grades each one enforcing, partial, advisory or unknown: a scanner with continue-on-error, || true or no fail flag is present but cannot stop a merge |
| CI platforms | GitHub first; several checks, SAST and CI-Tests among them, are GitHub-only | GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Azure Pipelines and Jenkins |
| Beyond CI | Code review, maintenance, licence, security policy, fuzzing, signed releases, binary artifacts | Not covered: zanadir stays inside the pipeline |
| Fixing gaps | Remediation text per check | zanadir fix prints ready-to-paste CI configuration, or writes a workflow |
| Output | A 0–10 score per check, JSON, SARIF, a badge | Table, JSON, SARIF, Markdown, a coverage badge |
When to use which
- Use Scorecard to judge a project, or a dependency you are about to adopt, on its overall security hygiene.
- Use zanadir to find out whether your own pipeline would stop a vulnerable dependency, a leaked secret or an injectable workflow, and to get the configuration that closes the gap.
- Use both: zanadir counts a Scorecard workflow as one of the workflow security controls it looks for.
Try zanadir
Scan a repository in your browserOr see how it maps to the OWASP Top 10 CI/CD Security Risks.