Frog-Proof Security: Streamlining The Sec In DevSecOps
summary
JFrog shows concrete fixes: a malicious VS Code/Cursor Solidity extension leads to an attacker siphoning about $500k wallet theft; research downgrades 88% downgrade of “critical” CVEs after contextual review. The stack adds transitive contextual analysis (precomputed dependency paths + applicability), runtime linking from Artifactory to Kubernetes to mark what’s actually running, and an agentic remediation with Copilot+curation that upgrades Apache Struts, patches code, verifies the build and proves the vulnerability is gone.
AI-written summary · about
chapters (8)
- 0:00Introduction to DevSecOps threats
- 1:06Malicious packages in npm and VS Code
- 5:03Prioritizing critical vulnerabilities
- 8:15Transitive dependencies analysis
- 10:02Demo of JFrog X-ray scanning
- 13:10Runtime security in production
- 15:39AI-powered vulnerability fixes
- 21:16Summary and Q&A
related talks
33mFrogs and Ducks, Your Sentinels for Open Source Security
29mFrom Vulnerabilities to Vigilance
36mElevating Innovation: GitHub & JFrog Paving the Way Forward
18mGlobal security at maximum velocity: Multi-Region and hybrid DevSecOps
36mJFrog Platform Innovation: Reloading Development Teams
28mDevSecOps - Security from Scratch
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
13mKeynote: Hacking the OSS Supply Chain