Scaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
summary
Finds and fixes concrete patterns at scale using CodeQL to locate vulnerable Java projects and OpenRewrite to make style-preserving AST edits. The workflow generates automated bulk pull request generation (e.g., 1,596 PRs to change HTTP→HTTPS with a ~40% merge rate, 164 PRs for zip slip), handles rate limits and naming/fork quirks, and runs recipes at scale via Moderne/Mad. Detections use data‑flow and control‑flow analysis; fixes are templated and verified, and many merges occur in practice.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:05Vulnerability story
- 5:39Finding fixes at scale
- 9:36Automated code transformations
- 12:44Three vulnerabilities and fixes
- 23:46PR generation challenges
- 28:15Campaign results
- 29:40Bulk PR best practices
- 33:54Final thoughts
- 36:47Q&A
related talks
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
01h 13mAutomating Security Fixes with OpenRewrite
44mSecurity Research with Open Source Software: Vol. Omega
50mExpanding the scope of refactoring to fix Java security problems
16mPerformance improvements: exposing hidden security fixes in Open Source
19mFlipping the script on application security
31mFrom Noise to Notes: Orchestrating SAST with Developers... (Adrián Puente Z.)