Achieving Positive Outcomes Across Ecosystems: Security Audits in Action
recording made private on YouTubehttps://youtu.be/kqsMk4hfJ4c
summary
OSTIF, a 10-year nonprofit, describes a four-plus year CNCF collaboration that runs 37 audits focused on deep source review and threat modeling rather than surface scans. First-time audits typically surface medium/high/critical bugs; repeated audits show far fewer. The program pairs expert reviewers with projects to find-and-fix, retest fixes, add fuzz testing and CI improvements, publishes detailed reports, and reports 100% recommend from surveyed maintainers.
AI-written summary · about
related talks
30mSuccess Stories in Open Source: Security Audits with OSTIF
39mManaging Audits for Critical Open Source Projects
29mSecurity Audits in Action: Helping Improve Multiple LF Energy Projects
41mManaging Audits for Critical Open Source Projects
41mInside the CNCF Project Security Reviews
17mA Sneak Peak Into Security Reviews with the Community
34mCNCF SIG-Security Intro
01h 02mDiscussion - Auditors, Sessions 3 & 4