Cleaning Your Applications' Dirty Laundry with Scumblr
summary
Open-source Scumblr 2.0 "Dirty Laundry" centralizes scans and metadata, runs multithreaded tasks (curl, Breakman, Bandit, Arachni/AppSpider integrations, sketchy screenshots) and syncs repos via GitHub sync, pulling Route53 entries and scanning 2100 applications with a three-person AppSec team. Demos show finding checked-in secrets and widespread occurrences, bulk-importing 65 sitemap URLs, flagging non-200 endpoints, deduplicating vuln sources, and supporting auto-remediation and an events audit log so the system actually works at scale.
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:26Audience Poll
- 1:18Agenda
- 1:45Netflix Application Security
- 3:11Netflix Security Challenges
- 5:50Proactive Security
- 7:03Matured Program
- 8:45Terminology
- 15:20Demo
- 20:07Metadata
- 21:18Configurable columns
- 22:05New task types
- 23:26Task groups
- 24:14Events
- 25:30Open Source
- 26:01Demos
- 26:25Bulk Add Results
- 31:17Identify Secret in HTML Response
- 33:58Scumblr Event Log
- 35:24Github Easter Egg
- 36:01GitHub Search
- 36:53Chaining
- 38:18Results
- 39:51Using Events
- 41:05Creating vulnerabilities manually
- 41:57Metadata search
- 43:27Why does this approach work
- 45:43We are hiring
related talks
32mAutomating Web Application Bug Hunting
39mBuilding your own large scale web security scanning infrastructure in 40 minutes
09mAutomated Application Security Testing
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
26mSecurity Automation For GraphQL
01h 00mSecurity Theatre
43mApplication Security is a Community Effort
49m"The SAST and the furious"