Before It's Out the Door Securing Outbound Open Source
summary
Walks through concrete outbound-open-source steps: a linked repo of templates and a sample security.md and responsible disclosure policy, prescriptive checks like copy and paste code without .git history, operational controls such as require 2FA and corporate group emails for package accounts, and governance actions like include the open source program in bug bounty scope. Covers CI log leakage, repo config and access-checklists, CLA and licensing choices, monitoring and decommission templates, and when to gate or publish.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:16Your Two Main Concerns
- 3:00The Journey
- 3:18Establish Your Open Source Governance Process
- 6:22Open Source Governance
- 8:02Open Source Security
- 11:19Code Review
- 15:28Supporting Infrastructure
- 17:44Recap
- 17:56PreRelease Review
- 21:40Project Security
- 23:45Congratulations
- 24:01The Basics
- 27:16Security Issues
- 29:51Tech Changes
- 30:23Hosting Community Projects
- 31:47Transferring Ownership
- 33:17Actions to Take
- 35:07Summary
related talks
37mA Practical Guide for Outbound Open Source - Which Scales and Can be Adapted Easily for Companies of Different Size
31mOperationalizing Open Source Projects: When the Rubber Meets the Road
21mOpen source security: advisories and workflows to keep open source secure
44mOpen Source Security: The World Needs Our Help
30mSecuring Open Source Supply Chains
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
32mOpen Source Contributions in Today’s World