Ace of Base: Meeting the OpenSSF Security Baseline with Minder
summary
Minder is an open source security platform now in the OpenSSF sandbox that observes repos, builds and artifacts and reconciles state to a declared desired state; rules are YAML, grouped into profiles, and Minder applies them via a continuous reconciliation loop. It monitors GitHub (experimental GitLab), offers Docker Compose or a free hosted instance, includes about 30 built‑in rules, can open remediation PRs automatically (does not auto‑merge), and flagged a malicious Python dependency during the demo.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 1:44What is OpenSSF Security Baseline
- 7:19Introducing Minder platform
- 10:28Rules and profiles in Minder
- 13:00Demo and Minder features
- 17:22Security Baseline profile in Minder
- 18:48Q&A session
related talks
42mDeveloping a Secure, Open Future
29mTurn Down That Noise: Why the OpenSSF Security Baseline Is Good for Maintainers
14mKeynote: All Your Base Are Belong to Us
37mOpenSSF Best Practices for Everyone!
29mWe're All Consumers (And That's Dandy)
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
57mFrontiers in Securing the Open Source Ecosystem
36mUsing OpenSSF's Allstar to Secure Your Organizations GitHub Repositories