Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
summary
Claims that automated bulk pull request generation can actually fix widespread OSS flaws using real tooling and measurable results. Uses CodeQL variant analysis to find issues, OpenRewrite format‑preserving AST recipes to write fixes, and Modern/Alpha Omega to deploy changes. Builds a bot that creates forks, applies diffs, and opens 1,596 PRs (164 for zip slip, 64 for tmpdir), achieves roughly a 40% merge rate, and navigates GitHub API rate limits and disclosure tradeoffs.
AI-written summary · about
chapters (13)
- 0:00Scaling security research
- 2:30HTTP dependency vulnerability
- 5:40Fixes beyond major servers
- 7:05CodeQL for vulnerability detection
- 10:57OpenRewrite for automated fixes
- 14:54Temporary directory hijacking
- 18:27Partial path reversal issues
- 24:49Zip Slip vulnerability
- 29:03Pull requests at scale
- 31:54Deploying fixes with Modern
- 37:10PR generation best practices
- 41:41Researchers' obligation to fix
- 43:46Conclusion
related talks
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All- 46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
44mSecurity Research with Open Source Software: Vol. Omega
01h 13mAutomating Security Fixes with OpenRewrite
19mFlipping the script on application security
40mUnderstanding OSS Risk Beyond Code Vulnerabilities- 44mSecurity Research with Open Source Software: Vol. Omega
21mHow To Make AI-Assisted OSS Contributions Review-Ready