Security Audits in Action: Helping Improve Multiple LF Energy Projects
summary
OSTIF reports ~20,000 hours of expert review across nearly 200 projects over 10 years and runs bespoke audits that include threat modeling, tooling review, CI/CD improvements and coordinated remediation. The Possible audit surfaces nine findings resolved and gets the project onto OSS-Fuzz with custom fuzzers; Everest is in final remediation steps. Audits avoid dumping issue lists, produce proofs of concept, and sometimes reveal improperly patched dependencies that require rework. Project-specific scoping drives outcomes.
AI-written summary · about
chapters (8)
- 0:00Introduction to security audits
- 3:39Why security audits matter
- 7:09Custom audit process explained
- 10:23Audits for Possible and Everest
- 12:12Results from Possible audit
- 14:01Everest audit progress
- 16:30Key takeaways and lessons
- 21:02Q&A session begins
related talks
39mManaging Audits for Critical Open Source Projects
30mSuccess Stories in Open Source: Security Audits with OSTIF
41mManaging Audits for Critical Open Source Projects
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
27mHealth Check-ups on OSS Software Projects: Managing Risks While Promoting (Re)use
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
37mOpenSSF Best Practices for Everyone!
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard