Adventures in Securing an Open Source Project: From Repo Security Zero...
summary
A real repository is intentionally sabotaged to a 1.2–1.9/10 Scorecard rating using missing tests, writable workflow tokens, vulnerable dependencies and an exploitable release workflow, then hardened stepwise to 9.6 by adding OpenSSF Scorecard checks, branch protection, commit signing, automated tests, automated releases and dependency automation via dependabot/renovate. The team measures impact at each step (score jumps: ~1.9 → 4.3 → 6.8 → 7.9 → 9.6) and shows which fixes give the largest security payoff for solo maintainers.
AI-written summary · about
chapters (12)
- 0:00Open source security intro
- 1:05Supply chain security
- 3:55Solo maintainer risks
- 6:02Project lifecycle risks
- 12:26Scorecard for security
- 16:20Sabotaging a project
- 18:06Basic security steps
- 21:20Branch protection & review
- 23:12Secure dependency management
- 25:40Safe package releases
- 28:28Advanced security tips
- 31:56Closing & Q&A
related talks
43mAdventures in Securing an Open Source Project: From Repo Security Zero to Hero
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
36mEstimating Security Risk Through Repository Mining