Automating Security Fixes with OpenRewrite
summary
Automates finding and patching known vulnerabilities across Java projects using OpenRewrite + Modern recipes tied into Maven/Gradle and a CLI that produces Git-ready patches and CSV reports; it upgrades vulnerable dependencies, applies Java security best-practice fixes, detects checked‑in secrets and OWASP Top10 patterns, and preserves project formatting via a lossless semantic tree. Empirical claim: automated fixes cover roughly half of security issues (implementation bugs), and the toolchain demonstrably generates branchable patches.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker welcome
- 1:25Why security must be built in
- 15:11OpenRewrite and security automation
- 35:47Toolchain and practical demo
- 49:56Vulnerable dependencies and fixes
- 1:00:17Java security best practices
- 1:12:04Summary and Q&A
related talks
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All- 46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
41mOpen Rewrite – Dive in Automated Refactoring
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
50mExpanding the scope of refactoring to fix Java security problems
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
31mKeep your dependencies in check
43mAutomate Code Changes - Bringing OpenRewrite to the IDE