OpenSSF Community Day North America 2025

Open-source software security depends not only on code quality but also on the health and effectiveness of developer communication. This session presents ongoing research developing “FORCE” (Framework for Open-Source Risk and Community Evaluation), a novel framework for proactively assessing OSS project risk. We will analyze communication patterns (sentiment, toxicity, outrage, stance, and key discussion topics) within GitHub repositories, combined with contributor network analysis and vulnerability data. This session will detail the methodology for creating the “Temporal Health Score” (THS), a composite metric designed to provide early warnings of potential security risks. We will discuss how prior research in areas like subtle toxicity detection and behavioral analysis informs the design of FORCE. The session will emphasize the potential for actionable insights for OSS maintainers, including strategies for improving communication, fostering collaboration, and mitigating identified risks. We also seek community feedback on the framework and its potential applications.