Building Secure Open Source Communities From the Ground Up
summary
Builds a centralized community hub and migrates ~75–80 repos in two waves, taking about nine months to publish a security and dependency policy. Implements container scanning with Trivy integrated via a one‑liner bash script that blocks releases on critical findings, uses Renovate vs Dependabot for different dependency workflows, adds JFrog X‑Ray and Codecov for impact analysis and coverage, applies least‑privilege repo roles, introduces life‑cycle badges for deprecated extensions, and records that cross‑team pair programming is required to make automation work.
AI-written summary · about
chapters (6)
related talks
35mPractical DevSecOps for private and open source projects
27mBuilding a Secure Open Source Project on GitHub
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
43mAdventures in Securing an Open Source Project: From Repo Security Zero...
40mCurating and Securing Open Source for the GovCloud
28mDevSecOps - Security from Scratch
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
20mJuggling the dual life of an enterprise open source project