Effective Vulnerability Management for Over 400 Projects at the Eclipse Foundation
summary
The Eclipse Foundation consolidates vulnerability intake across over 400 projects and 1,800 named committers by creating a centralized security team, a developer handbook, and a workflow that triages reports, maps them to the right project, and manages fixes in GitLab confidential issues while enabling private GitHub reporting. Challenges include dozens of GitHub/GitLab orgs, inconsistent versioning, copy‑pasted vulnerable code and no separate CI for security fixes. Progress is real — tooling, policies and training exist, about 20 CVEs so far — but metrics, SLOs and reduced committer burden remain works in progress.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:03Presenters
- 2:06Eclipse Foundation overview
- 3:08Supply chain security challenges
- 4:10Initial struggles
- 5:58Cultural shift
- 7:21Security Team setup
- 8:23Real-world vulnerability example
- 10:07Human-centered approach
- 13:39Roles of researchers, maintainers, and users
- 14:41Human transformation challenges
- 16:50Scaling processes
- 17:12Reporting workflow
- 19:15Fix coordination
- 20:17Current state
- 22:03Future goals
- 23:49Resources
- 24:31Dependency updates
- 26:39Boring yet effective
- 29:10Closing
related talks
23mManaging the unmanageable: community driven projects at Eclipse Foundation
27mEffective Vulnerability Management for a DevSecOps Pipeline
27mOpen Source Health - A Crisis of Expectations
19mCommunity-led Security at ASF
48mImproving the Security of a Large Open Source Project One Step...
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
37mPackage Vulnerability Management & Reporting Collaboration Space for...