Open Source SecurityCon Europe 2026
2026-03-23
Amsterdam, Netherlands
[SupplyChainSecurityCon @ Open Source Summit Europe 2023, Open Source SecurityCon North America 2025, Cloud Native SecurityCon Europe 2022, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon @ Open Source Summit North America 2024]
as the organisers put it
A new event that fosters collaboration and shares innovation in cloud native security and open source software security. Sessions will cover architecture and policy, secure software development…
who it's for
open source maintainers, product security engineers, cloud native engineers, devops engineers, site reliability engineers, compliance engineers
topics
SLSA level 3 provenance; Verification Summary Attestation (VSA); SBOM attestations and SIFT SBOMs; cosign and Sigstore post-quantum approaches; Tekton task commit validation; crate signing and trusted publishing (Rust); tokio-tar PAX parsing vulnerability (Tarmageddon); zero privilege architecture for pipelines; OAuth/JWT and SPIFFE for MCP servers; OpenSSF OSPS baseline mapping to NIST SSDF and NIS2
| title | author | length |
|---|---|---|
| Welcome + Opening Remarks | Brandt Keller, Constanze Roedig | 08m |
Morning housekeeping covers registration logistics (badge drink token, staggered lunch 11:30–13:30, captioning), a three‑question QR survey for attendee… | ||
| From Mild To Wild: How Hot Can Your SLSA Be? | Andrew McNamara, Adolfo García Veytia | 22m |
Policy shows concrete checks and demos: verify builder identity, build type, source commit and signatures (about 50 checks run for a Red Hat UBI image), then… | ||
| Lightning Talk: A Case Study in Cross-Ecosystem Security Response | Lori Lorusso | 11m |
Rust ecosystem responds to credential-phishing that hit npm and PyPI by leveraging an Alpha-Omega grantee network to cut detection and mitigation time. The… | ||
| From Packets to Pods: Lessons from 25... | Gerald Combs | 05m |
25 years of open source visibility lessons condensed into practical rules: networks and clusters need Wireshark and Falco–style packet and syscall visibility… | ||
| Trust, Tampering, and Transparency: What History Can Teach Us About Open Source... | Lisa Tagliaferri | 19m |
Shows that a 1697 sealed letter is read non-destructively by MIT with x‑ray imaging and computational unfolding, and about 600 Hague letters remain sealed for… | ||
| Upstream Collaboration for the Win (of the CRA)! | Georg Kunz, Jan Melen | 26m |
Argues that strong upstream collaboration materially eases CRA obligations by building developer networks, improving project health visibility, and speeding… | ||
| Panel: It’s Not If, It’s When - Practical Preparation for the Next Software Supply Chain Attack | Hannah Foxwell, Justin Cormack, Sal Kimmich, Erika Heidi, Josh Bressers | 36m |
Practical, tactical steps: generate high-quality SBOMs with tools like SIFT SBOMs, favour providers that can build packages from source so patches ship… | ||
| Zero Privilege Architecture - 3 Years Onward | Thijs Ebbers, Tadeo Sanchez | 23m |
ING's Zero Privilege Architecture underpins the on‑prem ICHP and claims zero security breaches and 100% uptime by making all changes occur only via reviewed… | ||
| Quantum Proofing Sigstore: A Tale of Three Approaches | Kevin Conner, Firas Ghanmi | 28m |
Three concrete prototypes add post‑quantum cryptography into Sigstore and cosign and each has clear tradeoffs. hybrid log dual‑signing records every entry and… | ||
| Tarmageddon: One Bug, Four Forks, and a Disclosure Scavenger Hunt | Marina Moore, Alex Zenla | 25m |
Discovery of a parsing bug in tokio-tar called Tarmageddon reveals a PAX header parsing flaw that lets an unpacker treat embedded data as files and enables… | ||
| Secure Your MCP Servers With OAuth, JWT, SPIFFE and More | Lin Sun, Yi Yang | 25m |
Demo builds a simple echo MCP server (runs on port 8000) and first adds OAuth by wiring Keycloak into the server, getting a JWT via the MCP Inspector and… | ||
| Simplifying Global Compliance for CNCF Projects With the OpenSSF OSPS Baseline | Madalin Neag | 28m |
OSPS Baseline releases a practical compliance stack: 40 requirements across three maturity levels covering access control, build and release, governance… | ||
| Thinking About Source Code Security in New Ways | Yongjae Chung, Justin Cappos | 27m |
Gittuf is a client-side security layer for Git that embeds policy, keys and an append-only reference state log inside repo refs so every clone can verify… | ||
| Lightning Talk: Your Most Privileged User Isn't Human: The Agent Security Blinds... | Atulpriya Sharma | 11m |
Kubernetes clusters end up giving AI agents broad service-account powers so a nonhuman identity makes unauditable changes: audit logs show only a service… | ||
| Lightning Talk: A Supply Chain Security View of OpenSearch | Ram Iyengar | 11m |
Quick audit of OpenSearch security posture with concrete fixes and tools: shows an OpenSSF best practices badge, runs OpenSSF scorecards and an OSV scanner… | ||
| Closing Remarks | Brandt Keller, Constanze Roedig | 03m |
Event organizers summarize outcomes, ask for concrete feedback via the post-event survey and QR codes, and report the conference is officially co-hosted by… | ||
| nothing matches | ||