Scaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 16:35· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Claims an automated pipeline that finds vulnerabilities with CodeQL and applies OpenRewrite transformations to produce 1,596 pull requests (40% merge rate) to fix HTTP->HTTPS and other Java issues; code preserves formatting, uses dataflow and control‑flow analysis to avoid false positives, and runs at scale via Moderne’s service indexing ~26,000 Java projects. The system generates PRs, signs commits, handles GitHub rate limits, and has already earned bug bounties and thousands more PRs across campaigns, demonstrating a practical, partially automated way to fix widespread OSS bugs.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:05Vulnerability story
- 5:39Finding fixes at scale
- 9:36Automated code transformations
- 12:44Three vulnerabilities and fixes
- 23:46PR generation challenges
- 28:15Campaign results
- 29:40Bulk PR best practices
- 33:54Final thoughts
- 36:47Q&A
related talks
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
01h 13mAutomating Security Fixes with OpenRewrite
23mStopping vulnerabilities at the source
16mPerformance improvements: exposing hidden security fixes in Open Source
19mFlipping the script on application security
52mSecurity as Code: A DevSecOps Approach
50mExpanding the scope of refactoring to fix Java security problems