OpenSSF Scorecard Infrastructure Funding

[SecurityCRob]

OpenSSF Scorecard relies upon Google Cloud infrastructure for its API, weekly scans and BigQuery data. The project received a series of credits for use of this infrastructure to operate. In August/September 2025, the remaining available credits were consumed. OpenSSF approved temporary operating budget to allow for a grace period, and in parallel the project was asked to prepare an updated roadmap, plan and proposal for long-term funding and project sustainability.

This issue is to collect and submit the proposal documents for review and discussion in the Dec. 9, 2025 TAC meeting.

[bobcallaway]

@justaugustus @spencerschrock are there any docs the TAC could review ahead of the meeting?

[spencerschrock]

@justaugustus @spencerschrock are there any docs the TAC could review ahead of the meeting?

We are finalizing our draft and discussing with CRob on 12/2. Would 1 week be enough early review?

[lehors]

I realize this might be a side conversation from this particular request for funding but when it comes to the roadmap I would like to know what is being planned to integrate with the best practices badge and security baseline. I think it is detrimental to our mission to have all these different measuring sticks.

[justaugustus]

@justaugustus @spencerschrock are there any docs the TAC could review ahead of the meeting?

An external, comment-able version of the proposal is now available at https://docs.google.com/document/d/1i_nR-nIBVlTz3nW1WnsS45Fyo4LFHefQTbcjJEcsmYQ/edit?usp=sharing.