Everybody Loves Snitches
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Ericsson builds GitSnitch to continuously scan GitHub event streams for company usernames, email domains, project names and commits, applying an allowlist, running secret scanners, and auto-notifying author plus two managerial levels when unapproved content appears. The tool collects contributor counts and project overlap for BI, is currently internal (not open source), and the demo breaks because author email removed from GitHub’s API, forcing workarounds and raising scaling and privacy tradeoffs for ~93,000 employees.
AI-written summary · about
chapters (16)
- 0:00Welcome
- 3:34Our roles at Ericsson OSPO
- 5:37Security and GitHub monitoring
- 8:52Tool design vs contributions
- 11:42Benefits of contribution monitoring
- 15:13Data for culture and talent
- 17:44Tool examples and details
- 20:13Demo challenges and API limits
- 21:58Open discussion and audience questions
- 23:46Audience contributions
- 27:17GitHub to email mapping
- 28:18Bosch’s contribution process
- 30:04Tool origin and open source
- 30:46Manual audits and non-approved
- 31:47Firewall monitoring trade-offs
- 33:15Security vs developer enablement
related talks
50mxGitGuard: ML-Based Secret Scanner for GitHub
01h 02mDeveloping secure software with GitHub
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
09mKeynote: Detecting Threats in GitHub with Falco
19mFlipping the script on application security
39mDon’t Ignore Those GitHub Security Alerts. Automate Them Into your Workflow
27mBulletproof Shoes
39mApisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub.