The intersection of InfoSec and DevOps

on YouTube ↗09m

" summary

WhiteSource scans build artifacts and source to map open‑source components, links each vulnerable library to exact code paths, and claims 70% of vulnerabilities not invoked so teams can prioritize real risk. It exposes all functions via REST APIs, supports CI/CD and serverless, and runs in parallel with builds — some customers run 400–500k CI jobs through it and a bank uses only the API. Company reports $35M investment, about 150 employees, and plans to double staff.

AI-written summary · about

" chapters (6)

1. 0:00Intro
2. 0:12What is WhiteSource
3. 1:05Open source resistance
4. 2:23Whats coming next
5. 5:17How customers are implementing WhiteSource
6. 6:41WhiteSource API and GUI

" related talks

• 09minterviewed – Azi CohenAzi Cohen · O'Reilly Security Conference 2017 - New York, NY
• 48mThe Quick Wins of DevSecOpsSven Ruppert · Java Day Istanbul 2022
• 42mAssessing the Risk of Open-source Components Using OpenSSF's ScorecardLaurent Simon, Naveen Srinivasan · SupplyChainSecurityCon at Open Source Summit North America 2022
• 27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...Tracy Ragan · Open Source Summit North America 2025
• 54mSupply Chain Security for OpenSource ProjectsSven Ruppert · Voxxed Days Cluj-Napoca 2022
• 29mSecuring the Unseen: Defending Against Open Source Software Supply Chain AttacksLawrence Crowther · Open Source Summit Japan + AI_dev 2024
• 18mSecuring InnerSourceLucas Gonze · InnerSource Summit 2025
• 27mHow Do You Trust Your Open Source Software?Naveen Srinivasan, Brian Russell · CloudNativeSecurityCon North America 2023