Make It Fixable: Preparing for Security Vulnerability Reports
summary
Companies must provide a clear contact channel for vulnerability reports and plan to actually deliver fixes: build systems, signing, and a reliable auto-update architecture for devices and servers. Avoid relying on bug bounties as the primary defense—they drive triage overhead and low-quality noise. Run continuous dependency auditing to catch issues like Left‑Pad and Equifax, enforce default-unique passwords or staged setup flows for embedded devices, and validate recovery with test backups so failures like the GitLab incident or Maersk ransomware don’t become catastrophes.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 1:05Why make it fixable
- 5:48Unable to roll out fixes
- 12:35No control over dependencies
- 16:32The team is gone
- 18:41Vulnerability in your code
- 21:53My boss made me do it
- 24:00Protect what you make
- 26:54User experience and security
- 27:58Design for your users
related talks
44mMake It Fixable
48mHow to report a vulnerability: Responsible Disclosure for Developers
10mHandling Security Issues
29mGet the Freaking Basics Right!
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
17mSay Vulunerabilities One More Time - Ending Open Source Security Fatigue
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus