"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
summary
Alpha-Omega funds proactive scanning and OpenRefactory runs an ICR intelligent code repair static analyzer that audits packages at scale, producing attestations for ~55 CWEs. Recent runs cover ~6,500 PyPI artifacts (scanning ~1,000/month), find 325 bugs (140 security, 51 high), and see ~60% fixed with only ~3–4% outright rejected. A focused sweep of 719 dependencies for Apache Airflow finds 16 bugs (4 high). The program is Project Clean Beach, emphasizes low false positives and automated fixes to give maintainers time to remediate.
AI-written summary · about
chapters (9)
- 0:00Software supply chain security
- 3:54Alpha Omega's mission
- 6:44Supply chain risk approach
- 11:19Proactive auditing for vulnerabilities
- 18:38Project Clean Beach
- 24:43Intelligent Code Repair
- 35:15Auditing Apache Airflow
- 41:18Human factors in security
- 44:26Future plans
related talks
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
32mAirflow Beach Cleaning - Securing Supply Chain
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
37mHow to Serve Open Source Maintainers Without Annoying Them?
28mAirflow Beach Cleaning - Supply Chain Security with Community in Mind
44mSecurity Research with Open Source Software: Vol. Omega- 44mSecurity Research with Open Source Software: Vol. Omega
38mFinding Security Issues in Open Source