Fortify Open Source Select is the sourcing-time OSS curation product inside the OpenText AppSec line. Where Fortify SCA detects vulnerabilities and license risk in dependencies that are already in the build, Open Source Select runs upstream of that: a curated catalog of pre-vetted OSS components developers can pick from, with vulnerability history, license posture, project hygiene, and known-bad indicators evaluated before adoption. Programs that consume Open Source Select narrow the dependency surface to libraries the program is willing to depend on.
Comparison to Checkmarx Repository Health is fair. Both products operate in the sourcing-time governance space, scoring OSS projects before they enter the dependency tree. Open Source Select takes the curated-catalog shape (here is a vetted list, pick from it); Repository Health takes the scoring-engine shape (here is a score, gate against it). Programs picking Open Source Select are picking the catalog discipline; programs picking Repository Health are picking the score discipline. Both are valid and address the same risk from different angles.
Layered governance comes from pairing it with Fortify SCA. Open Source Select narrows the front-end (what enters the dependency tree), and Fortify SCA evaluates the back-end (what risk exists in dependencies that did enter). Running both gives prevention plus detection, while running only Fortify SCA gives detection without prevention. The right shape depends on whether the program has the operational maturity to enforce sourcing decisions versus only react to detected risk.
Open Source Select is not an OSS-license scanner, and treating it as one wastes it. The product's value is the curation discipline, with developers picking from a vetted catalog rather than reaching into the public registry directly. Programs that license Open Source Select but never restrict developers to the catalog get the catalog without the discipline, and the program does sourcing-time governance in name only. Merito's engagement defines the catalog-restriction policy, the override workflow for legitimate exceptions, and the developer enablement that turns the catalog into a real sourcing discipline.
Ideal use cases
- Curated OSS catalog for pre-vetted dependency selection
- Sourcing-time OSS governance complementing Fortify SCA detection
- Provenance-aware OSS sourcing for regulated and federal programs
- Pairing Open Source Select with Fortify SCA for layered prevention plus detection
- Migrating off ad-hoc OSS sourcing to a curated catalog with audit trail