Kubescape achieves all six OpenSSF Security Slam badges for Kubernetes security

Kubescape, a CNCF-incubating project focused on Kubernetes security, has successfully completed all six project-level badges in the Fall 2026 OpenSSF Security Slam. This initiative involved a coordinated effort between maintainers and community contributors to harden the project's supply chain and development workflows.

The project addressed technical debt by updating legacy security metadata, pinning GitHub Actions to specific commits, and reducing overly broad workflow token permissions. These improvements ensure that Kubescape, which often runs with privileged access in production clusters, maintains a verifiable and robust security posture across its 25+ microservices and repositories.

Technical hardening and Security Slam achievements

• Workflow Hardening: Ten or more repositories were secured by pinning GitHub Actions to specific commits and implementing tighter workflow token permissions to prevent unauthorized execution.
• Automated Compliance: Five core repositories integrated Security Insights v2.2.0 and established automated weekly Open Source Project Security Baseline (OSPS Baseline) scans.
• Supply Chain Improvements: The project merged approximately 85 security-focused pull requests, including specific protections against CSV formula injection and stricter handling of registry credentials.
• Regulatory Readiness: The project completed the CRA Readiness badge, which involved documenting stewardship and escalation procedures to align with the EU Cyber Resilience Act.
• Tooling Contributions: Community work identified and fixed a mismatch between Security Insights and baseline scanner recognition of secret-scanning tools, contributing a fix back to the upstream scanner repository.

Why it matters

As a tool used to secure Kubernetes environments, Kubescape's improved supply chain security provides higher confidence for enterprise users running the software in privileged production roles. The project's successful use of OpenSSF tools provides a repeatable blueprint for other CNCF and cloud-native projects to automate security metadata and baseline compliance.