Improving the Security of a Large Open Source Project One Step...
summary
Node.js documents a threat model that narrows what counts as a vulnerability, uses HackerOne to take private reports and issue CVEs, and runs a rotating triage team of about five people to avoid single-person burnout. Fixes land in a private repo because public CI would disclose issues, then a release steward coordinates a 26‑step security release while CI is locked. Recent wins include an experimental permission model, automated dependency-update tooling and an OSSF scorecard program; Windows and CI platform expertise remain scarce.
AI-written summary · about
chapters (17)
- 0:00Node.js security intro
- 1:28Node.js project background
- 4:55Reactive security process
- 8:27Threat model workflow
- 13:22Private security fixes
- 16:31Security release process
- 19:02Proactive security overview
- 20:26Dependency checks automation
- 22:10Node.js permission model
- 25:49Security best practices doc
- 27:37Automate dependency updates
- 29:04OSSF Scorecard & best practices
- 32:58One-click security releases
- 33:59Supply chain security review
- 34:40Individual contributions
- 38:15Organizational support
- 40:43Q&A
related talks
48mImproving the Security of a Large Open Source Project One Step at a Time
47mImproving the Security of a Large Open Source Project One Step at a Time
27mPanel: Building A Secure Ecosystem for Node.js
49mImproving FOSS Security
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
27mState of Node.js Security
39mOpen source security: who’s responsible?