Success Stories in Open Source: Security Audits with OSTIF
summary
OSTIF presents a repeatable audit pipeline that refines independent code review for open source, running 12 CNCF audits in 2025 and a decade of work. Audits dig deep and find late-stage vulnerabilities, produce PoCs, drive fixes, and deliver fixed verification and published reports for projects like git, Kubernetes, Ruby on Rails, php-src, linkerd, libmicrohttpd2 and logback. The process also builds custom fuzzing and threat models, improves supply-chain checks, and helps funders and maintainers get fixes implemented.
AI-written summary · about
chapters (10)
- 0:00Introduction to success stories
- 1:10Why security audits matter
- 5:48Open source security audits
- 8:38Collaboration in audits
- 11:31KIA and STOR audit results
- 12:58CNCF security program
- 15:32Sovereign Tech Agency projects
- 17:40Benefits of security audits
- 20:52Recommendations for projects
- 23:21Q&A session
related talks
39mManaging Audits for Critical Open Source Projects
29mSecurity Audits in Action: Helping Improve Multiple LF Energy Projects
41mManaging Audits for Critical Open Source Projects
30mORT: Automate your open source policy using Open Source & Inner Source
49mTrustworthy Open Source: The Consequences of Success
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
37mOpenSSF Best Practices for Everyone!
35mOpen source security: Opportunity or oxymoron?