diff --git a/.gitignore b/.gitignore
index 384d0cfa..eda72798 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,15 +2,15 @@
 scorecard
 gitblobcache
 clients/githubrepo/roundtripper/tokens/server/github-auth-server
-cron/data/add/add
-cron/data/validate/validate
-cron/data/update/projects-update
-cron/controller/controller
-cron/worker/worker
-cron/cii/cii-worker
-cron/shuffle/shuffle
-cron/webhook/webhook
-cron/bq/data-transfer
+cron/internal/data/add/add
+cron/internal/data/validate/validate
+cron/internal/data/update/projects-update
+cron/internal/controller/controller
+cron/internal/worker/worker
+cron/internal/cii/cii-worker
+cron/internal/shuffle/shuffle
+cron/internal/webhook/webhook
+cron/internal/bq/data-transfer
 
 # Binaries for programs and plugins.
 *.exe
diff --git a/Makefile b/Makefile
index 230cd723..b5270ec8 100644
--- a/Makefile
+++ b/Makefile
@@ -74,16 +74,16 @@ check-osv: $(install)
 	go list -m -f '{{if not (or  .Main)}}{{.Path}}@{{.Version}}_{{.Replace}}{{end}}' all \
 			| stunning-tribble 
 
-add-projects: ## Adds new projects to ./cron/data/projects.csv
-add-projects: ./cron/data/projects.csv | build-add-script
-	# Add new projects to ./cron/data/projects.csv
-	./cron/data/add/add ./cron/data/projects.csv ./cron/data/projects.new.csv
-	mv ./cron/data/projects.new.csv ./cron/data/projects.csv
+add-projects: ## Adds new projects to ./cron/internal/data/projects.csv
+add-projects: ./cron/internal/data/projects.csv | build-add-script
+	# Add new projects to ./cron/internal/data/projects.csv
+	./cron/internal/data/add/add ./cron/internal/data/projects.csv ./cron/internal/data/projects.new.csv
+	mv ./cron/internal/data/projects.new.csv ./cron/internal/data/projects.csv
 
-validate-projects: ## Validates ./cron/data/projects.csv
-validate-projects: ./cron/data/projects.csv | build-validate-script
-	# Validate ./cron/data/projects.csv
-	./cron/data/validate/validate ./cron/data/projects.csv
+validate-projects: ## Validates ./cron/internal/data/projects.csv
+validate-projects: ./cron/internal/data/projects.csv | build-validate-script
+	# Validate ./cron/internal/data/projects.csv
+	./cron/internal/data/validate/validate ./cron/internal/data/projects.csv
 
 tree-status: | all-targets-update-dependencies ## Verify tree is clean and all changes are committed
 	# Verify the tree is clean and all changes are commited
@@ -103,11 +103,11 @@ build: ## Build all binaries and images in the repo.
 build: $(build-targets)
 
 build-proto: ## Compiles and generates all required protobufs
-build-proto: cron/data/request.pb.go cron/data/metadata.pb.go
-cron/data/request.pb.go: cron/data/request.proto |  $(PROTOC)
-	protoc --go_out=../../../ cron/data/request.proto
-cron/data/metadata.pb.go: cron/data/metadata.proto |  $(PROTOC)
-	protoc --go_out=../../../ cron/data/metadata.proto
+build-proto: cron/internal/data/request.pb.go cron/internal/data/metadata.pb.go
+cron/internal/data/request.pb.go: cron/internal/data/request.proto |  $(PROTOC)
+	protoc --go_out=../../../ cron/internal/data/request.proto
+cron/internal/data/metadata.pb.go: cron/internal/data/metadata.proto |  $(PROTOC)
+	protoc --go_out=../../../ cron/internal/data/metadata.proto
 
 generate-mocks: ## Compiles and generates all mocks using mockgen.
 generate-mocks: clients/mockclients/repo_client.go clients/mockclients/repo.go clients/mockclients/cii_client.go checks/mockclients/vulnerabilities.go cmd/packagemanager_mockclient.go
@@ -147,24 +147,24 @@ build-releaser: ## Runs goreleaser on the repo
 
 build-controller: ## Runs go build on the cron PubSub controller
 	# Run go build on the cron PubSub controller
-	cd cron/controller && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o controller
+	cd cron/internal/controller && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o controller
 
 build-worker: ## Runs go build on the cron PubSub worker
 	# Run go build on the cron PubSub worker
-	cd cron/worker && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o worker
+	cd cron/internal/worker && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o worker
 
 build-cii-worker: ## Runs go build on the CII worker
 	# Run go build on the CII worker
-	cd cron/cii && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o cii-worker
+	cd cron/internal/cii && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o cii-worker
 
 build-shuffler: ## Runs go build on the cron shuffle script
 	# Run go build on the cron shuffle script
-	cd cron/shuffle && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o shuffle
+	cd cron/internal/shuffle && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o shuffle
 
 build-bq-transfer: ## Runs go build on the BQ transfer cron job
-build-bq-transfer: ./cron/bq/*.go
+build-bq-transfer: ./cron/internal/bq/*.go
 	# Run go build on the Copier cron job
-	cd cron/bq && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o data-transfer
+	cd cron/internal/bq && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o data-transfer
 
 build-github-server: ## Runs go build on the GitHub auth server
 build-github-server: ./clients/githubrepo/roundtripper/tokens/*
@@ -174,25 +174,25 @@ build-github-server: ./clients/githubrepo/roundtripper/tokens/*
 
 build-webhook: ## Runs go build on the cron webhook
 	# Run go build on the cron webhook
-	cd cron/webhook && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o webhook
+	cd cron/internal/webhook && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o webhook
 
 build-add-script: ## Runs go build on the add script
-build-add-script: cron/data/add/add
-cron/data/add/add: cron/data/add/*.go cron/data/*.go cron/data/projects.csv
+build-add-script: cron/internal/data/add/add
+cron/internal/data/add/add: cron/internal/data/add/*.go cron/internal/data/*.go cron/internal/data/projects.csv
 	# Run go build on the add script
-	cd cron/data/add && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o add
+	cd cron/internal/data/add && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o add
 
 build-validate-script: ## Runs go build on the validate script
-build-validate-script: cron/data/validate/validate
-cron/data/validate/validate: cron/data/validate/*.go cron/data/*.go cron/data/projects.csv
+build-validate-script: cron/internal/data/validate/validate
+cron/internal/data/validate/validate: cron/internal/data/validate/*.go cron/internal/data/*.go cron/internal/data/projects.csv
 	# Run go build on the validate script
-	cd cron/data/validate && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o validate
+	cd cron/internal/data/validate && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o validate
 
 build-update-script: ## Runs go build on the update script
-build-update-script: cron/data/update/projects-update
-cron/data/update/projects-update:  cron/data/update/*.go cron/data/*.go
+build-update-script: cron/internal/data/update/projects-update
+cron/internal/data/update/projects-update:  cron/internal/data/update/*.go cron/internal/data/*.go
 	# Run go build on the update script
-	cd cron/data/update && CGO_ENABLED=0 go build -trimpath -a -tags netgo -ldflags '$(LDFLAGS)'  -o projects-update
+	cd cron/internal/data/update && CGO_ENABLED=0 go build -trimpath -a -tags netgo -ldflags '$(LDFLAGS)'  -o projects-update
 
 ko-targets = scorecard-ko cron-controller-ko cron-worker-ko cron-cii-worker-ko cron-bq-transfer-ko cron-webhook-ko cron-github-server-ko
 .PHONY: ko-build-everything $(ko-targets)
@@ -212,7 +212,7 @@ cron-controller-ko:
 			   --push=false \
 			   --sbom=none \
 			   --platform=$(PLATFORM)\
-			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/controller
+			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/internal/controller
 cron-worker-ko:
 	$(call_create_kocache_path)
 	KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-batch-worker LDFLAGS="$(LDFLAGS)" \
@@ -220,7 +220,7 @@ cron-worker-ko:
 			   --push=false \
 			   --sbom=none \
 			   --platform=$(PLATFORM)\
-			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/worker
+			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/internal/worker
 cron-cii-worker-ko:
 	$(call_create_kocache_path)
 	KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-cii-worker LDFLAGS="$(LDFLAGS)" \
@@ -228,7 +228,7 @@ cron-cii-worker-ko:
 			   --push=false \
 			   --sbom=none \
 			   --platform=$(PLATFORM)\
-			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/cii
+			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/internal/cii
 cron-bq-transfer-ko:
 	$(call_create_kocache_path)
 	KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-bq-transfer LDFLAGS="$(LDFLAGS)" \
@@ -236,7 +236,7 @@ cron-bq-transfer-ko:
 			   --push=false \
 			   --sbom=none \
 			   --platform=$(PLATFORM)\
-			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/bq
+			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/internal/bq
 cron-webhook-ko:
 	$(call_create_kocache_path)
 	KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-cron-webhook LDFLAGS="$(LDFLAGS)" \
@@ -244,7 +244,7 @@ cron-webhook-ko:
 			   --push=false \
 			   --sbom=none \
 			   --platform=$(PLATFORM)\
-			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/webhook
+			   --tags latest,$(GIT_VERSION),$(GIT_HASH) github.com/ossf/scorecard/v4/cron/internal/webhook
 cron-github-server-ko:
 	$(call_create_kocache_path)
 	KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-github-server LDFLAGS="$(LDFLAGS)" \
@@ -261,15 +261,15 @@ dockerbuild: $(docker-targets)
 scorecard-docker:
 	DOCKER_BUILDKIT=1 docker build . --file Dockerfile --tag $(IMAGE_NAME)
 cron-controller-docker:
-	DOCKER_BUILDKIT=1 docker build . --file cron/controller/Dockerfile --tag $(IMAGE_NAME)-batch-controller
+	DOCKER_BUILDKIT=1 docker build . --file cron/internal/controller/Dockerfile --tag $(IMAGE_NAME)-batch-controller
 cron-worker-docker:
-	DOCKER_BUILDKIT=1 docker build . --file cron/worker/Dockerfile --tag $(IMAGE_NAME)-batch-worker
+	DOCKER_BUILDKIT=1 docker build . --file cron/internal/worker/Dockerfile --tag $(IMAGE_NAME)-batch-worker
 cron-cii-worker-docker:
-	DOCKER_BUILDKIT=1 docker build . --file cron/cii/Dockerfile --tag $(IMAGE_NAME)-cii-worker
+	DOCKER_BUILDKIT=1 docker build . --file cron/internal/cii/Dockerfile --tag $(IMAGE_NAME)-cii-worker
 cron-bq-transfer-docker:
-	DOCKER_BUILDKIT=1 docker build . --file cron/bq/Dockerfile --tag $(IMAGE_NAME)-bq-transfer
+	DOCKER_BUILDKIT=1 docker build . --file cron/internal/bq/Dockerfile --tag $(IMAGE_NAME)-bq-transfer
 cron-webhook-docker:
-	DOCKER_BUILDKIT=1 docker build . --file cron/webhook/Dockerfile --tag ${IMAGE_NAME}-webhook
+	DOCKER_BUILDKIT=1 docker build . --file cron/internal/webhook/Dockerfile --tag ${IMAGE_NAME}-webhook
 cron-github-server-docker:
 	DOCKER_BUILDKIT=1 docker build . --file clients/githubrepo/roundtripper/tokens/server/Dockerfile --tag ${IMAGE_NAME}-github-server
 ###############################################################################
diff --git a/cron/cloudbuild/cii.yaml b/cron/cloudbuild/cii.yaml
index 33b4431f..c3c2856f 100644
--- a/cron/cloudbuild/cii.yaml
+++ b/cron/cloudbuild/cii.yaml
@@ -18,5 +18,5 @@ steps:
   '--build-arg', 'COMMIT_SHA=$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-cii-worker:$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-cii-worker:latest',
-  '-f', 'cron/cii/Dockerfile']
+  '-f', 'cron/internal/cii/Dockerfile']
 images: ['gcr.io/openssf/scorecard-cii-worker']
diff --git a/cron/cloudbuild/controller.yaml b/cron/cloudbuild/controller.yaml
index 23d6f137..a7db912e 100644
--- a/cron/cloudbuild/controller.yaml
+++ b/cron/cloudbuild/controller.yaml
@@ -18,5 +18,5 @@ steps:
   '--build-arg', 'COMMIT_SHA=$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-batch-controller:$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-batch-controller:latest',
-  '-f', 'cron/controller/Dockerfile']
+  '-f', 'cron/internal/controller/Dockerfile']
 images: ['gcr.io/openssf/scorecard-batch-controller']
diff --git a/cron/cloudbuild/transfer.yaml b/cron/cloudbuild/transfer.yaml
index e5a1042a..e370777e 100644
--- a/cron/cloudbuild/transfer.yaml
+++ b/cron/cloudbuild/transfer.yaml
@@ -17,5 +17,5 @@ steps:
   args: ['build', '.',
   '-t', 'gcr.io/openssf/scorecard-bq-transfer:$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-bq-transfer:latest',
-  '-f', 'cron/bq/Dockerfile']
+  '-f', 'cron/internal/bq/Dockerfile']
 images: ['gcr.io/openssf/scorecard-bq-transfer']
diff --git a/cron/cloudbuild/webhook.release.yaml b/cron/cloudbuild/webhook.release.yaml
index d160baa7..4d448348 100644
--- a/cron/cloudbuild/webhook.release.yaml
+++ b/cron/cloudbuild/webhook.release.yaml
@@ -17,5 +17,5 @@ steps:
   args: ['build', '.',
   '-t', 'gcr.io/openssf/scorecard-webhook-releasetest:$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-webhook-releasetest:latest',
-  '-f', 'cron/webhook/Dockerfile']
+  '-f', 'cron/internal/webhook/Dockerfile']
 images: ['gcr.io/openssf/scorecard-webhook-releasetest']
diff --git a/cron/cloudbuild/worker.yaml b/cron/cloudbuild/worker.yaml
index 41749248..e1663203 100644
--- a/cron/cloudbuild/worker.yaml
+++ b/cron/cloudbuild/worker.yaml
@@ -20,5 +20,5 @@ steps:
   args: ['build', '.',
   '-t', 'gcr.io/openssf/scorecard-batch-worker:$COMMIT_SHA',
   '-t', 'gcr.io/openssf/scorecard-batch-worker:latest',
-  '-f', 'cron/worker/Dockerfile']
+  '-f', 'cron/internal/worker/Dockerfile']
 images: ['gcr.io/openssf/scorecard-batch-worker']
diff --git a/cron/bq/Dockerfile b/cron/internal/bq/Dockerfile
similarity index 87%
rename from cron/bq/Dockerfile
rename to cron/internal/bq/Dockerfile
index 6dc2983e..1aff4da7 100644
--- a/cron/bq/Dockerfile
+++ b/cron/internal/bq/Dockerfile
@@ -25,5 +25,5 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-bq-transfer
 
 FROM gcr.io/distroless/base:nonroot@sha256:19d927c16ddb5415d5f6f529dbbeb13c460b84b304b97af886998d3fcf18ac81
-COPY --from=transfer /src/cron/bq/data-transfer cron/bq/data-transfer
-ENTRYPOINT ["cron/bq/data-transfer"]
+COPY --from=transfer /src/cron/internal/bq/data-transfer cron/internal/bq/data-transfer
+ENTRYPOINT ["cron/internal/bq/data-transfer"]
diff --git a/cron/bq/main.go b/cron/internal/bq/main.go
similarity index 98%
rename from cron/bq/main.go
rename to cron/internal/bq/main.go
index 5882643e..ef89ae93 100644
--- a/cron/bq/main.go
+++ b/cron/internal/bq/main.go
@@ -27,8 +27,8 @@ import (
 
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/ossf/scorecard/v4/cron/config"
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/config"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 type shardSummary struct {
diff --git a/cron/bq/transfer.go b/cron/internal/bq/transfer.go
similarity index 100%
rename from cron/bq/transfer.go
rename to cron/internal/bq/transfer.go
diff --git a/cron/cii/Dockerfile b/cron/internal/cii/Dockerfile
similarity index 88%
rename from cron/cii/Dockerfile
rename to cron/internal/cii/Dockerfile
index 6f6ffef1..d244b8f7 100644
--- a/cron/cii/Dockerfile
+++ b/cron/internal/cii/Dockerfile
@@ -25,5 +25,5 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-cii-worker
 
 FROM gcr.io/distroless/base:nonroot@sha256:46d4514c17aca7a68559ee03975983339fc548e6d1014e2d7633f9123f2d3c59
-COPY --from=cii /src/cron/cii/cii-worker cron/cii/cii-worker
-ENTRYPOINT ["cron/cii/cii-worker"]
+COPY --from=cii /src/cron/internal/cii/cii-worker cron/internal/cii/cii-worker
+ENTRYPOINT ["cron/internal/cii/cii-worker"]
diff --git a/cron/cii/main.go b/cron/internal/cii/main.go
similarity index 96%
rename from cron/cii/main.go
rename to cron/internal/cii/main.go
index b936263f..e3836497 100644
--- a/cron/cii/main.go
+++ b/cron/internal/cii/main.go
@@ -24,8 +24,8 @@ import (
 	"strings"
 
 	"github.com/ossf/scorecard/v4/clients"
-	"github.com/ossf/scorecard/v4/cron/config"
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/config"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 const ciiBaseURL = "https://bestpractices.coreinfrastructure.org/projects.json"
diff --git a/cron/config/config.go b/cron/internal/config/config.go
similarity index 100%
rename from cron/config/config.go
rename to cron/internal/config/config.go
diff --git a/cron/config/config.yaml b/cron/internal/config/config.yaml
similarity index 100%
rename from cron/config/config.yaml
rename to cron/internal/config/config.yaml
diff --git a/cron/config/config_test.go b/cron/internal/config/config_test.go
similarity index 100%
rename from cron/config/config_test.go
rename to cron/internal/config/config_test.go
diff --git a/cron/config/testdata/basic.yaml b/cron/internal/config/testdata/basic.yaml
similarity index 100%
rename from cron/config/testdata/basic.yaml
rename to cron/internal/config/testdata/basic.yaml
diff --git a/cron/config/testdata/missing_field.yaml b/cron/internal/config/testdata/missing_field.yaml
similarity index 100%
rename from cron/config/testdata/missing_field.yaml
rename to cron/internal/config/testdata/missing_field.yaml
diff --git a/cron/controller/Dockerfile b/cron/internal/controller/Dockerfile
similarity index 71%
rename from cron/controller/Dockerfile
rename to cron/internal/controller/Dockerfile
index e775d295..046e4903 100644
--- a/cron/controller/Dockerfile
+++ b/cron/internal/controller/Dockerfile
@@ -23,7 +23,7 @@ FROM base AS shuffle
 ARG TARGETOS
 ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-shuffler
-RUN ./cron/shuffle/shuffle 2500 cron/data/projects.csv cron/data/projects.release.csv
+RUN ./cron/internal/shuffle/shuffle 2500 cron/internal/data/projects.csv cron/internal/data/projects.release.csv
 
 FROM base AS controller
 ARG TARGETOS
@@ -31,7 +31,7 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-controller
 
 FROM gcr.io/distroless/base:nonroot@sha256:d65ac1a65a4d82a48ebd0a22aea2acdd95d7abeeda245dfee932ec0018c781f4
-COPY ./cron/data/projects*csv cron/data/
-COPY --from=shuffle /src/cron/data/projects.release.csv cron/data/projects.release.csv
-COPY --from=controller /src/cron/controller/controller cron/controller/controller
-ENTRYPOINT ["cron/controller/controller"]
+COPY ./cron/internal/data/projects*csv cron/data/
+COPY --from=shuffle /src/cron/internal/data/projects.release.csv cron/internal/data/projects.release.csv
+COPY --from=controller /src/cron/internal/controller/controller cron/internal/controller/controller
+ENTRYPOINT ["cron/internal/controller/controller"]
diff --git a/cron/controller/main.go b/cron/internal/controller/main.go
similarity index 96%
rename from cron/controller/main.go
rename to cron/internal/controller/main.go
index 6fa1ccbf..7b5ff9d3 100644
--- a/cron/controller/main.go
+++ b/cron/internal/controller/main.go
@@ -26,9 +26,9 @@ import (
 	"sigs.k8s.io/release-utils/version"
 
 	"github.com/ossf/scorecard/v4/clients"
-	"github.com/ossf/scorecard/v4/cron/config"
-	"github.com/ossf/scorecard/v4/cron/data"
-	"github.com/ossf/scorecard/v4/cron/pubsub"
+	"github.com/ossf/scorecard/v4/cron/internal/config"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
+	"github.com/ossf/scorecard/v4/cron/internal/pubsub"
 )
 
 var headSHA = clients.HeadSHA
diff --git a/cron/data/README.md b/cron/internal/data/README.md
similarity index 100%
rename from cron/data/README.md
rename to cron/internal/data/README.md
diff --git a/cron/data/add/main.go b/cron/internal/data/add/main.go
similarity index 98%
rename from cron/data/add/main.go
rename to cron/internal/data/add/main.go
index d7da4eb4..a452aaab 100644
--- a/cron/data/add/main.go
+++ b/cron/internal/data/add/main.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 // Script to add new project repositories to the projects.csv file:
diff --git a/cron/data/add/main_test.go b/cron/internal/data/add/main_test.go
similarity index 98%
rename from cron/data/add/main_test.go
rename to cron/internal/data/add/main_test.go
index 2ee0401d..3a7ea8ac 100644
--- a/cron/data/add/main_test.go
+++ b/cron/internal/data/add/main_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 func lessThanURI(x, y data.RepoFormat) bool {
diff --git a/cron/data/add/testdata/add_metadata.csv b/cron/internal/data/add/testdata/add_metadata.csv
similarity index 100%
rename from cron/data/add/testdata/add_metadata.csv
rename to cron/internal/data/add/testdata/add_metadata.csv
diff --git a/cron/data/add/testdata/no_change.csv b/cron/internal/data/add/testdata/no_change.csv
similarity index 100%
rename from cron/data/add/testdata/no_change.csv
rename to cron/internal/data/add/testdata/no_change.csv
diff --git a/cron/data/add/testdata/skip_empty.csv b/cron/internal/data/add/testdata/skip_empty.csv
similarity index 100%
rename from cron/data/add/testdata/skip_empty.csv
rename to cron/internal/data/add/testdata/skip_empty.csv
diff --git a/cron/data/add/testdata/skip_empty_2.csv b/cron/internal/data/add/testdata/skip_empty_2.csv
similarity index 100%
rename from cron/data/add/testdata/skip_empty_2.csv
rename to cron/internal/data/add/testdata/skip_empty_2.csv
diff --git a/cron/data/add/testdata/skip_latest.csv b/cron/internal/data/add/testdata/skip_latest.csv
similarity index 100%
rename from cron/data/add/testdata/skip_latest.csv
rename to cron/internal/data/add/testdata/skip_latest.csv
diff --git a/cron/data/blob.go b/cron/internal/data/blob.go
similarity index 98%
rename from cron/data/blob.go
rename to cron/internal/data/blob.go
index 183bc5f8..fb43eb82 100644
--- a/cron/data/blob.go
+++ b/cron/internal/data/blob.go
@@ -26,7 +26,7 @@ import (
 	// Needed to link in GCP drivers.
 	_ "gocloud.dev/blob/gcsblob"
 
-	"github.com/ossf/scorecard/v4/cron/config"
+	"github.com/ossf/scorecard/v4/cron/internal/config"
 )
 
 const (
diff --git a/cron/data/blob_test.go b/cron/internal/data/blob_test.go
similarity index 100%
rename from cron/data/blob_test.go
rename to cron/internal/data/blob_test.go
diff --git a/cron/data/format.go b/cron/internal/data/format.go
similarity index 100%
rename from cron/data/format.go
rename to cron/internal/data/format.go
diff --git a/cron/data/format_test.go b/cron/internal/data/format_test.go
similarity index 100%
rename from cron/data/format_test.go
rename to cron/internal/data/format_test.go
diff --git a/cron/data/iterator.go b/cron/internal/data/iterator.go
similarity index 100%
rename from cron/data/iterator.go
rename to cron/internal/data/iterator.go
diff --git a/cron/data/iterator_test.go b/cron/internal/data/iterator_test.go
similarity index 100%
rename from cron/data/iterator_test.go
rename to cron/internal/data/iterator_test.go
diff --git a/cron/data/metadata.pb.go b/cron/internal/data/metadata.pb.go
similarity index 100%
rename from cron/data/metadata.pb.go
rename to cron/internal/data/metadata.pb.go
diff --git a/cron/data/metadata.proto b/cron/internal/data/metadata.proto
similarity index 100%
rename from cron/data/metadata.proto
rename to cron/internal/data/metadata.proto
diff --git a/cron/data/projects.csv b/cron/internal/data/projects.csv
similarity index 100%
rename from cron/data/projects.csv
rename to cron/internal/data/projects.csv
diff --git a/cron/data/request.pb.go b/cron/internal/data/request.pb.go
similarity index 100%
rename from cron/data/request.pb.go
rename to cron/internal/data/request.pb.go
diff --git a/cron/data/request.proto b/cron/internal/data/request.proto
similarity index 100%
rename from cron/data/request.proto
rename to cron/internal/data/request.proto
diff --git a/cron/data/testdata/basic.csv b/cron/internal/data/testdata/basic.csv
similarity index 100%
rename from cron/data/testdata/basic.csv
rename to cron/internal/data/testdata/basic.csv
diff --git a/cron/data/testdata/comment.csv b/cron/internal/data/testdata/comment.csv
similarity index 100%
rename from cron/data/testdata/comment.csv
rename to cron/internal/data/testdata/comment.csv
diff --git a/cron/data/testdata/empty_row.csv b/cron/internal/data/testdata/empty_row.csv
similarity index 100%
rename from cron/data/testdata/empty_row.csv
rename to cron/internal/data/testdata/empty_row.csv
diff --git a/cron/data/testdata/extra_column.csv b/cron/internal/data/testdata/extra_column.csv
similarity index 100%
rename from cron/data/testdata/extra_column.csv
rename to cron/internal/data/testdata/extra_column.csv
diff --git a/cron/data/testdata/failing_urls.csv b/cron/internal/data/testdata/failing_urls.csv
similarity index 100%
rename from cron/data/testdata/failing_urls.csv
rename to cron/internal/data/testdata/failing_urls.csv
diff --git a/cron/data/update/dependency.go b/cron/internal/data/update/dependency.go
similarity index 99%
rename from cron/data/update/dependency.go
rename to cron/internal/data/update/dependency.go
index b8cc11c3..79b5fe65 100644
--- a/cron/data/update/dependency.go
+++ b/cron/internal/data/update/dependency.go
@@ -30,7 +30,7 @@ import (
 	"golang.org/x/tools/go/vcs"
 
 	"github.com/ossf/scorecard/v4/clients/githubrepo"
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 var (
diff --git a/cron/data/update/main.go b/cron/internal/data/update/main.go
similarity index 96%
rename from cron/data/update/main.go
rename to cron/internal/data/update/main.go
index 7e8eb2e0..8b5df908 100644
--- a/cron/data/update/main.go
+++ b/cron/internal/data/update/main.go
@@ -19,7 +19,7 @@ import (
 	"bytes"
 	"os"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 // Adds "project=${PROJECT},dependency=true" to the repositories metadata.
diff --git a/cron/data/validate/main.go b/cron/internal/data/validate/main.go
similarity index 96%
rename from cron/data/validate/main.go
rename to cron/internal/data/validate/main.go
index aeb8141b..47ddac04 100644
--- a/cron/data/validate/main.go
+++ b/cron/internal/data/validate/main.go
@@ -19,7 +19,7 @@ import (
 	"log"
 	"os"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 // Validates data.Iterator used by production PubSub cron job.
diff --git a/cron/data/writer.go b/cron/internal/data/writer.go
similarity index 100%
rename from cron/data/writer.go
rename to cron/internal/data/writer.go
diff --git a/cron/data/writer_test.go b/cron/internal/data/writer_test.go
similarity index 100%
rename from cron/data/writer_test.go
rename to cron/internal/data/writer_test.go
diff --git a/cron/format/bq.raw.schema b/cron/internal/format/bq.raw.schema
similarity index 100%
rename from cron/format/bq.raw.schema
rename to cron/internal/format/bq.raw.schema
diff --git a/cron/format/json.go b/cron/internal/format/json.go
similarity index 100%
rename from cron/format/json.go
rename to cron/internal/format/json.go
diff --git a/cron/format/json.raw.schema b/cron/internal/format/json.raw.schema
similarity index 100%
rename from cron/format/json.raw.schema
rename to cron/internal/format/json.raw.schema
diff --git a/cron/format/json.v2.schema b/cron/internal/format/json.v2.schema
similarity index 100%
rename from cron/format/json.v2.schema
rename to cron/internal/format/json.v2.schema
diff --git a/cron/format/json_raw_results.go b/cron/internal/format/json_raw_results.go
similarity index 100%
rename from cron/format/json_raw_results.go
rename to cron/internal/format/json_raw_results.go
diff --git a/cron/format/json_test.go b/cron/internal/format/json_test.go
similarity index 100%
rename from cron/format/json_test.go
rename to cron/internal/format/json_test.go
diff --git a/cron/format/mock_doc.go b/cron/internal/format/mock_doc.go
similarity index 100%
rename from cron/format/mock_doc.go
rename to cron/internal/format/mock_doc.go
diff --git a/cron/format/schema_gen.go b/cron/internal/format/schema_gen.go
similarity index 100%
rename from cron/format/schema_gen.go
rename to cron/internal/format/schema_gen.go
diff --git a/cron/format/schema_gen_test.go b/cron/internal/format/schema_gen_test.go
similarity index 100%
rename from cron/format/schema_gen_test.go
rename to cron/internal/format/schema_gen_test.go
diff --git a/cron/format/testdata/bq-valid.schema b/cron/internal/format/testdata/bq-valid.schema
similarity index 100%
rename from cron/format/testdata/bq-valid.schema
rename to cron/internal/format/testdata/bq-valid.schema
diff --git a/cron/format/testdata/check1.json b/cron/internal/format/testdata/check1.json
similarity index 100%
rename from cron/format/testdata/check1.json
rename to cron/internal/format/testdata/check1.json
diff --git a/cron/format/testdata/check2.json b/cron/internal/format/testdata/check2.json
similarity index 100%
rename from cron/format/testdata/check2.json
rename to cron/internal/format/testdata/check2.json
diff --git a/cron/format/testdata/check3.json b/cron/internal/format/testdata/check3.json
similarity index 100%
rename from cron/format/testdata/check3.json
rename to cron/internal/format/testdata/check3.json
diff --git a/cron/format/testdata/check4.json b/cron/internal/format/testdata/check4.json
similarity index 100%
rename from cron/format/testdata/check4.json
rename to cron/internal/format/testdata/check4.json
diff --git a/cron/format/testdata/check5.json b/cron/internal/format/testdata/check5.json
similarity index 100%
rename from cron/format/testdata/check5.json
rename to cron/internal/format/testdata/check5.json
diff --git a/cron/format/testdata/check6.json b/cron/internal/format/testdata/check6.json
similarity index 100%
rename from cron/format/testdata/check6.json
rename to cron/internal/format/testdata/check6.json
diff --git a/cron/format/testdata/valid.schema b/cron/internal/format/testdata/valid.schema
similarity index 100%
rename from cron/format/testdata/valid.schema
rename to cron/internal/format/testdata/valid.schema
diff --git a/cron/monitoring/exporter.go b/cron/internal/monitoring/exporter.go
similarity index 98%
rename from cron/monitoring/exporter.go
rename to cron/internal/monitoring/exporter.go
index b5d76972..b7ecb8ef 100644
--- a/cron/monitoring/exporter.go
+++ b/cron/internal/monitoring/exporter.go
@@ -24,7 +24,7 @@ import (
 	"contrib.go.opencensus.io/exporter/stackdriver/monitoredresource/gcp"
 	"go.opencensus.io/stats/view"
 
-	"github.com/ossf/scorecard/v4/cron/config"
+	"github.com/ossf/scorecard/v4/cron/internal/config"
 )
 
 var errorUndefinedExporter = errors.New("unsupported exporterType")
diff --git a/cron/monitoring/printer.go b/cron/internal/monitoring/printer.go
similarity index 100%
rename from cron/monitoring/printer.go
rename to cron/internal/monitoring/printer.go
diff --git a/cron/pubsub/publisher.go b/cron/internal/pubsub/publisher.go
similarity index 97%
rename from cron/pubsub/publisher.go
rename to cron/internal/pubsub/publisher.go
index 6310e166..fc420049 100644
--- a/cron/pubsub/publisher.go
+++ b/cron/internal/pubsub/publisher.go
@@ -28,7 +28,7 @@ import (
 	_ "gocloud.dev/pubsub/gcppubsub"
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 var errorPublish = errors.New("total errors when publishing")
diff --git a/cron/pubsub/publisher_test.go b/cron/internal/pubsub/publisher_test.go
similarity index 97%
rename from cron/pubsub/publisher_test.go
rename to cron/internal/pubsub/publisher_test.go
index 0c9ec24c..1bec7171 100644
--- a/cron/pubsub/publisher_test.go
+++ b/cron/internal/pubsub/publisher_test.go
@@ -21,7 +21,7 @@ import (
 
 	"gocloud.dev/pubsub"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 type mockSucceedTopic struct{}
diff --git a/cron/pubsub/subscriber.go b/cron/internal/pubsub/subscriber.go
similarity index 96%
rename from cron/pubsub/subscriber.go
rename to cron/internal/pubsub/subscriber.go
index 86ecff60..fcca1a51 100644
--- a/cron/pubsub/subscriber.go
+++ b/cron/internal/pubsub/subscriber.go
@@ -21,7 +21,7 @@ import (
 
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 // ErrorInParse indicates there was an error while unmarshalling the protocol buffer message.
diff --git a/cron/pubsub/subscriber_gcs.go b/cron/internal/pubsub/subscriber_gcs.go
similarity index 98%
rename from cron/pubsub/subscriber_gcs.go
rename to cron/internal/pubsub/subscriber_gcs.go
index 8af766a4..a4dcd553 100644
--- a/cron/pubsub/subscriber_gcs.go
+++ b/cron/internal/pubsub/subscriber_gcs.go
@@ -24,7 +24,7 @@ import (
 	pubsub "cloud.google.com/go/pubsub/apiv1"
 	pubsubpb "google.golang.org/genproto/googleapis/pubsub/v1"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 const (
diff --git a/cron/pubsub/subscriber_gocloud.go b/cron/internal/pubsub/subscriber_gocloud.go
similarity index 97%
rename from cron/pubsub/subscriber_gocloud.go
rename to cron/internal/pubsub/subscriber_gocloud.go
index 91e50ded..acb5fa11 100644
--- a/cron/pubsub/subscriber_gocloud.go
+++ b/cron/internal/pubsub/subscriber_gocloud.go
@@ -23,7 +23,7 @@ import (
 	// Needed to link in GCP drivers.
 	_ "gocloud.dev/pubsub/gcppubsub"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 type receiver interface {
diff --git a/cron/pubsub/subscriber_gocloud_test.go b/cron/internal/pubsub/subscriber_gocloud_test.go
similarity index 98%
rename from cron/pubsub/subscriber_gocloud_test.go
rename to cron/internal/pubsub/subscriber_gocloud_test.go
index b9541280..b4d5199f 100644
--- a/cron/pubsub/subscriber_gocloud_test.go
+++ b/cron/internal/pubsub/subscriber_gocloud_test.go
@@ -23,7 +23,7 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 var repo1 = "repo1"
diff --git a/cron/shuffle/main.go b/cron/internal/shuffle/main.go
similarity index 96%
rename from cron/shuffle/main.go
rename to cron/internal/shuffle/main.go
index 805b0c18..671f8f0f 100644
--- a/cron/shuffle/main.go
+++ b/cron/internal/shuffle/main.go
@@ -21,7 +21,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 func main() {
diff --git a/cron/webhook/Dockerfile b/cron/internal/webhook/Dockerfile
similarity index 88%
rename from cron/webhook/Dockerfile
rename to cron/internal/webhook/Dockerfile
index a4290aff..377d9952 100644
--- a/cron/webhook/Dockerfile
+++ b/cron/internal/webhook/Dockerfile
@@ -25,5 +25,5 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-webhook
 
 FROM gcr.io/distroless/base:nonroot@sha256:d65ac1a65a4d82a48ebd0a22aea2acdd95d7abeeda245dfee932ec0018c781f4
-COPY --from=webhook /src/cron/webhook/webhook cron/webhook/webhook
-ENTRYPOINT ["cron/webhook/webhook"]
+COPY --from=webhook /src/cron/internal/webhook/webhook cron/internal/webhook/webhook
+ENTRYPOINT ["cron/internal/webhook/webhook"]
diff --git a/cron/webhook/main.go b/cron/internal/webhook/main.go
similarity index 98%
rename from cron/webhook/main.go
rename to cron/internal/webhook/main.go
index 3f69121b..b6fc889a 100644
--- a/cron/webhook/main.go
+++ b/cron/internal/webhook/main.go
@@ -26,7 +26,7 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/google"
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/ossf/scorecard/v4/cron/data"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
 )
 
 const stableTag = "stable"
diff --git a/cron/worker/Dockerfile b/cron/internal/worker/Dockerfile
similarity index 88%
rename from cron/worker/Dockerfile
rename to cron/internal/worker/Dockerfile
index 5125079b..48cdb221 100644
--- a/cron/worker/Dockerfile
+++ b/cron/internal/worker/Dockerfile
@@ -25,5 +25,5 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-worker
 
 FROM gcr.io/distroless/base:nonroot@sha256:d65ac1a65a4d82a48ebd0a22aea2acdd95d7abeeda245dfee932ec0018c781f4
-COPY --from=worker /src/cron/worker/worker cron/worker/worker
-ENTRYPOINT ["cron/worker/worker"]
+COPY --from=worker /src/cron/internal/worker/worker cron/internal/worker/worker
+ENTRYPOINT ["cron/internal/worker/worker"]
diff --git a/cron/worker/main.go b/cron/internal/worker/main.go
similarity index 96%
rename from cron/worker/main.go
rename to cron/internal/worker/main.go
index e5850bc2..e539a8c2 100644
--- a/cron/worker/main.go
+++ b/cron/internal/worker/main.go
@@ -30,11 +30,11 @@ import (
 	"github.com/ossf/scorecard/v4/clients"
 	"github.com/ossf/scorecard/v4/clients/githubrepo"
 	githubstats "github.com/ossf/scorecard/v4/clients/githubrepo/stats"
-	"github.com/ossf/scorecard/v4/cron/config"
-	"github.com/ossf/scorecard/v4/cron/data"
-	format "github.com/ossf/scorecard/v4/cron/format"
-	"github.com/ossf/scorecard/v4/cron/monitoring"
-	"github.com/ossf/scorecard/v4/cron/pubsub"
+	"github.com/ossf/scorecard/v4/cron/internal/config"
+	"github.com/ossf/scorecard/v4/cron/internal/data"
+	format "github.com/ossf/scorecard/v4/cron/internal/format"
+	"github.com/ossf/scorecard/v4/cron/internal/monitoring"
+	"github.com/ossf/scorecard/v4/cron/internal/pubsub"
 	docs "github.com/ossf/scorecard/v4/docs/checks"
 	sce "github.com/ossf/scorecard/v4/errors"
 	"github.com/ossf/scorecard/v4/log"