ossf/tac

Technical Advisory Council

152

958 commits

updated Sep 17, 2026

See the code

README

OpenSSF Technical Advisory Council (TAC)

The OpenSSF Technical Advisory Council is responsible for oversight of the various Technical Initiatives (TI) of the OpenSSF.

Get Involved

Although the TAC is composed of a set of official members listed below, any community member is welcome to participate in the TAC discussions.

Official communications occur on the TAC mailing list. Manage your subscriptions to Open SSF mailing lists.

Informal discussions occur in the TAC channel of the OpenSSF Slack. To join, use the following invite link.

Use GitHub Issues to request and discuss agenda items.

If you need support in any part of the process, please email operations@openssf.org.

Meetings

The TAC meetings minutes are online and appear on the OpenSSF Community Calendar.

Meetings are also recorded and posted to the OpenSSF YouTube channel.

TAC Members

NamePositionEmailOrganizationTerm
Arnaud J Le Horslehors@us.ibm.comIBMJanuary 2026 - December 2027
Bob CallawayVice Chairbcallaway@google.comGoogleJanuary 2026 - December 2026
Michael Liebermanmike@kusari.devKusariJanuary 2025 - December 2026
Zach SteindlerChairsteiza@github.comGitHubJanuary 2026 - December 2026
Michael Scovettamichael.scovetta@microsoft.comMicrosoftJanuary 2026 - December 2027
Carlos Tadeu Panato Juniorctadeu@gmail.comChainguardSeptember 2026 - December 2026
Stephen Augustusopenssf@auggie.devBloomberg L.P.January 2026 - December 2026*
Georg Kunzgeorg.kunz@ericsson.comEricssonJanuary 2026 - December 2026*
Tracy Ragantracy@deployhub.comDeployHubJanuary 2026 - December 2026*

NOTE: *-marked entries denote TAC members appointed by the OpenSSF Governing Board; all other members are community-elected.

Charter

The TAC is chartered as part of the Open Source Security Foundation Charter.

Technical Initiatives

The governance of TIs is documented in the process section. This section provides you with all the information about the different types of initiatives and how they are managed, as well as how to propose a new initiative. It also covers the different levels of maturity a TI can be in, the requirements that must be met to move up to the next level, as well as the benefits that come with each level.

The following Technical Initiatives have been approved by the TAC. You may learn more about their status through their quarterly reports.

Working Groups (WGs)

NameRepositoryNotesStaff ContactStatus
AI/ML SecurityGitHubMeeting NotesJeff DiecksIncubating
BEAR (Belonging, Empowerment, Allyship, and Representation)GitHubMeeting NotesStacey PotterIncubating
Best Practices for Open Source DevelopersGitHubMeeting NotesJeff DiecksGraduated
Global Cyber PolicyGitHubMeeting NotesJeff Diecks & Kris BorchersSandbox
ORBIT (Open Resources for Baselines, Interoperability, and Tooling)GitHubMeeting NotesJeff DiecksSandbox
Securing Critical ProjectsGitHubMeeting NotesKris BorchersArchived
Securing Software RepositoriesGitHubMeeting NotesKris BorchersGraduated
Supply Chain IntegrityGitHubMeeting NotesKris BorchersIncubating
Vulnerability DisclosuresGitHubMeeting NotesJeff DiecksGraduated

Projects

NameRepositoryWebsiteSponsoring OrgStatus
AMPELSupply Chain Integrity WGSandbox
Best Practices BadgeGitHubhttps://www.bestpractices.dev/Best Practices WGGraduated
BomctlGitHubTBDSandbox
BOMHortGitHubhttps://docs.bomhort.dev/WG Supply Chain IntegritySandbox
Criticality ScoreGitHubVulnerability Disclosures WGTBD
CVE-BIN-TOOLGitHubTBDSandbox
darnitGitHubSupply Chain Integrity WGSandbox
Fuzz IntrospectorGitHubTBDTBD
GemaraGitHubhttps://gemara.openssf.org/ORBIT WGSandbox
GUACGitHubhttps://guac.shSupply Chain Integrity WGIncubating
gittufGitHubhttps://gittuf.dev/Supply Chain Integrity WGIncubating
Malicious PackagesGitHubSecuring Software Repositories WGSandbox
MinderGitHubhttps://mindersec.dev/ORBIT WGSandbox
Model signingGitHubAI/ML Security WGSandbox
OpenBaoGitHubhttps://openbao.org/TBDSandbox
OpenSSF ScorecardGitHubhttps://securityscorecards.dev/Best Practices WGIncubating
OpenVEXGitHubVulnerability Disclosures WGSandbox
OSPS BaselineGitHubhttps://baseline.openssf.org/ORBIT WGSandbox
OSS-CRSGitHubhttps://oss-crs.openssf.org/AI/ML Security WGSandbox
OSV SchemaGitHubhttps://ossf.github.io/osv-schema/Vulnerability Disclosures WGTBD
Package AnalysisGitHubSecuring Software Repositories WGTBD
PrivateerGitHubhttps://privateerproj.comORBIT WGSandbox
ProtobomGitHubTBDSandbox
Repository Service for TUFGitHubhttps://repository-service-tuf.readthedocs.io/Securing Software Repositories WGIncubating
SBOMitGitHubTBDSandbox
Secure Agentic FrameworkGitHubAI/ML Security WGSandbox
Security Insights SpecGitHubhttps://security-insights.openssf.org/ORBIT WGSandbox
SigstoreGitHubhttps://www.sigstore.dev/OpenSSF TACGraduated
SLSAGitHubhttps://slsa.dev/Supply Chain Integrity WGGraduated
ZarfGitHubhttps://zarf.dev/Supply Chain Integrity WGSandbox

OpenSSF affiliated projects

NameRepositoryStatus
Core Toolchain Infrastructurehttps://git.coretoolchain.dev/TBD
Alpha Omegahttps://github.com/ossf/alpha-omegaTBD

Special Interest Groups (SIGs)

SIGs can be created and managed without formal approval from the TAC. The following is for informational purposes only.

NameRepository/Home PageGoverning Org
CVD Guideshttps://github.com/ossf/oss-vulnerability-guideVulnerability Disclosures WG
OpenVEXhttps://github.com/ossf/OpenVEXVulnerability Disclosures WG
Educationhttps://github.com/ossf/educationBest Practices WG
Memory Safetyhttps://github.com/ossf/Memory-SafetyBest Practices WG
C/C++ Compiler Optionshttps://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Compiler-Hardening-GuidesBest Practices WG
Python Hardeninghttps://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Secure-Coding-Guide-for-PythonBest Practices WG
Security Baselinehttps://github.com/ossf/security-baselineORBIT WG
SBOM Everywherehttps://github.com/ossf/sbom-everywhereTBD
ORBIT Launchpadhttps://github.com/ossf/orbit-launchpadORBIT WG
Cyber Reasoning SystemsMeeting NotesAI/ML Security WG
E2E Model ProvenanceMeeting NotesAI/ML Security WG

Overview Diagrams

Diagrams with an overview of the OpenSSF, including its projects and SIGs, are available in the OpenSSF Main Deck.

Antitrust Policy

Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.

Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.

Contributors

(top 30 of 76)

SecurityCRob

243 commits

lehors

92 commits

hythloda

53 commits

bobcallaway

50 commits

ossf/tac

Technical Advisory Council

152

958 commits

updated Sep 17, 2026

See the code

README

OpenSSF Technical Advisory Council (TAC)

The OpenSSF Technical Advisory Council is responsible for oversight of the various Technical Initiatives (TI) of the OpenSSF.

Get Involved

Although the TAC is composed of a set of official members listed below, any community member is welcome to participate in the TAC discussions.

Official communications occur on the TAC mailing list. Manage your subscriptions to Open SSF mailing lists.

Informal discussions occur in the TAC channel of the OpenSSF Slack. To join, use the following invite link.

Use GitHub Issues to request and discuss agenda items.

If you need support in any part of the process, please email operations@openssf.org.

Meetings

The TAC meetings minutes are online and appear on the OpenSSF Community Calendar.

Meetings are also recorded and posted to the OpenSSF YouTube channel.

TAC Members

NamePositionEmailOrganizationTerm
Arnaud J Le Horslehors@us.ibm.comIBMJanuary 2026 - December 2027
Bob CallawayVice Chairbcallaway@google.comGoogleJanuary 2026 - December 2026
Michael Liebermanmike@kusari.devKusariJanuary 2025 - December 2026
Zach SteindlerChairsteiza@github.comGitHubJanuary 2026 - December 2026
Michael Scovettamichael.scovetta@microsoft.comMicrosoftJanuary 2026 - December 2027
Carlos Tadeu Panato Juniorctadeu@gmail.comChainguardSeptember 2026 - December 2026
Stephen Augustusopenssf@auggie.devBloomberg L.P.January 2026 - December 2026*
Georg Kunzgeorg.kunz@ericsson.comEricssonJanuary 2026 - December 2026*
Tracy Ragantracy@deployhub.comDeployHubJanuary 2026 - December 2026*

NOTE: *-marked entries denote TAC members appointed by the OpenSSF Governing Board; all other members are community-elected.

Charter

The TAC is chartered as part of the Open Source Security Foundation Charter.

Technical Initiatives

The governance of TIs is documented in the process section. This section provides you with all the information about the different types of initiatives and how they are managed, as well as how to propose a new initiative. It also covers the different levels of maturity a TI can be in, the requirements that must be met to move up to the next level, as well as the benefits that come with each level.

The following Technical Initiatives have been approved by the TAC. You may learn more about their status through their quarterly reports.

Working Groups (WGs)

NameRepositoryNotesStaff ContactStatus
AI/ML SecurityGitHubMeeting NotesJeff DiecksIncubating
BEAR (Belonging, Empowerment, Allyship, and Representation)GitHubMeeting NotesStacey PotterIncubating
Best Practices for Open Source DevelopersGitHubMeeting NotesJeff DiecksGraduated
Global Cyber PolicyGitHubMeeting NotesJeff Diecks & Kris BorchersSandbox
ORBIT (Open Resources for Baselines, Interoperability, and Tooling)GitHubMeeting NotesJeff DiecksSandbox
Securing Critical ProjectsGitHubMeeting NotesKris BorchersArchived
Securing Software RepositoriesGitHubMeeting NotesKris BorchersGraduated
Supply Chain IntegrityGitHubMeeting NotesKris BorchersIncubating
Vulnerability DisclosuresGitHubMeeting NotesJeff DiecksGraduated

Projects

NameRepositoryWebsiteSponsoring OrgStatus
AMPELSupply Chain Integrity WGSandbox
Best Practices BadgeGitHubhttps://www.bestpractices.dev/Best Practices WGGraduated
BomctlGitHubTBDSandbox
BOMHortGitHubhttps://docs.bomhort.dev/WG Supply Chain IntegritySandbox
Criticality ScoreGitHubVulnerability Disclosures WGTBD
CVE-BIN-TOOLGitHubTBDSandbox
darnitGitHubSupply Chain Integrity WGSandbox
Fuzz IntrospectorGitHubTBDTBD
GemaraGitHubhttps://gemara.openssf.org/ORBIT WGSandbox
GUACGitHubhttps://guac.shSupply Chain Integrity WGIncubating
gittufGitHubhttps://gittuf.dev/Supply Chain Integrity WGIncubating
Malicious PackagesGitHubSecuring Software Repositories WGSandbox
MinderGitHubhttps://mindersec.dev/ORBIT WGSandbox
Model signingGitHubAI/ML Security WGSandbox
OpenBaoGitHubhttps://openbao.org/TBDSandbox
OpenSSF ScorecardGitHubhttps://securityscorecards.dev/Best Practices WGIncubating
OpenVEXGitHubVulnerability Disclosures WGSandbox
OSPS BaselineGitHubhttps://baseline.openssf.org/ORBIT WGSandbox
OSS-CRSGitHubhttps://oss-crs.openssf.org/AI/ML Security WGSandbox
OSV SchemaGitHubhttps://ossf.github.io/osv-schema/Vulnerability Disclosures WGTBD
Package AnalysisGitHubSecuring Software Repositories WGTBD
PrivateerGitHubhttps://privateerproj.comORBIT WGSandbox
ProtobomGitHubTBDSandbox
Repository Service for TUFGitHubhttps://repository-service-tuf.readthedocs.io/Securing Software Repositories WGIncubating
SBOMitGitHubTBDSandbox
Secure Agentic FrameworkGitHubAI/ML Security WGSandbox
Security Insights SpecGitHubhttps://security-insights.openssf.org/ORBIT WGSandbox
SigstoreGitHubhttps://www.sigstore.dev/OpenSSF TACGraduated
SLSAGitHubhttps://slsa.dev/Supply Chain Integrity WGGraduated
ZarfGitHubhttps://zarf.dev/Supply Chain Integrity WGSandbox

OpenSSF affiliated projects

NameRepositoryStatus
Core Toolchain Infrastructurehttps://git.coretoolchain.dev/TBD
Alpha Omegahttps://github.com/ossf/alpha-omegaTBD

Special Interest Groups (SIGs)

SIGs can be created and managed without formal approval from the TAC. The following is for informational purposes only.

NameRepository/Home PageGoverning Org
CVD Guideshttps://github.com/ossf/oss-vulnerability-guideVulnerability Disclosures WG
OpenVEXhttps://github.com/ossf/OpenVEXVulnerability Disclosures WG
Educationhttps://github.com/ossf/educationBest Practices WG
Memory Safetyhttps://github.com/ossf/Memory-SafetyBest Practices WG
C/C++ Compiler Optionshttps://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Compiler-Hardening-GuidesBest Practices WG
Python Hardeninghttps://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/Secure-Coding-Guide-for-PythonBest Practices WG
Security Baselinehttps://github.com/ossf/security-baselineORBIT WG
SBOM Everywherehttps://github.com/ossf/sbom-everywhereTBD
ORBIT Launchpadhttps://github.com/ossf/orbit-launchpadORBIT WG
Cyber Reasoning SystemsMeeting NotesAI/ML Security WG
E2E Model ProvenanceMeeting NotesAI/ML Security WG

Overview Diagrams

Diagrams with an overview of the OpenSSF, including its projects and SIGs, are available in the OpenSSF Main Deck.

Antitrust Policy

Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.

Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.

Contributors

(top 30 of 76)

SecurityCRob

243 commits

lehors

92 commits

hythloda

53 commits

bobcallaway

50 commits