From 3ad05800708abf2ed90cccafb0716ee14ef04977 Mon Sep 17 00:00:00 2001
From: AIOSAI <aipass.system@gmail.com>
Date: Wed, 3 Jun 2026 14:37:43 -0700
Subject: [PATCH] docs(readme): add OpenSSF Best Practices passing badge
 (DPLAN-0193)

---
 CHANGELOG.md | 5 +++++
 README.md    | 1 +
 2 files changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index decfcb13..0a9efb91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,6 +33,11 @@ and this project uses [Calendar Versioning](https://calver.org/) in the format
   flowed into handlers but was never logged, leaving no way to tell an internal
   main-turn fire from a real sub-agent fire. Pure visibility; no behavior change.
   Groundwork for #606. (#606)
+- **OpenSSF Best Practices passing badge** — AIPass earned the OpenSSF Best
+  Practices (CII) **passing** badge (100% of criteria), added to the README badge
+  cluster. Self-certified across all six categories — basics, change control,
+  reporting, quality, security, and analysis. Complements the existing OpenSSF
+  Scorecard, lifting the `CII-Best-Practices` check from 0. (DPLAN-0193)
 
 ### Changed
 
diff --git a/README.md b/README.md
index 15362898..947edb80 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
 [![Give Feedback](https://img.shields.io/badge/Give-Feedback-brightgreen)](https://github.com/AIOSAI/AIPass/issues/new?template=feedback.yml)
 [![codecov](https://codecov.io/gh/AIOSAI/AIPass/graph/badge.svg)](https://codecov.io/gh/AIOSAI/AIPass)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/AIOSAI/AIPass/badge)](https://scorecard.dev/viewer/?uri=github.com/AIOSAI/AIPass)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13095/badge)](https://www.bestpractices.dev/projects/13095)
 
 <p align="center">
   <img src="assets/logo.png" alt="AIPass" width="400" />