How to Find Secure Software in Open Source Repositories
summary
Explains how to assess open‑source components with concrete checks: generate an SBOM (CycloneDX/SPDX), scan licenses with Dependency‑Track, detect secrets with GitHub/GitLab scanners or tools like gitLeaks and truffleHog, and map vulnerabilities from NVD/Google OSV. Cites measurable incidents: log4j: ~60 exploits in 3 days and >1,000,000 attacks, Toyota token leak exposing ~14,000 accounts, and ~9% of Docker images containing secrets. Presents a free site called find secure software that analyzes npm packages for compliance, exposures and threats.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 0:53What is secure software
- 2:12Salsa Framework
- 2:56Question
- 3:12Software Components
- 4:18Risk Management
- 5:21Risk Categories
- 8:35Licenses
- 10:46Tools Standards
- 11:23Secrets
- 12:06Potential Impact
- 12:59Prevention
- 13:26Vulnerability
- 14:13Examples
- 15:43Wax
- 16:13Mitigations
- 18:09Digital signatures
- 19:48Impact of digital signatures
- 20:29Impact of malware
- 21:57Dealing with malware
- 23:07Find Secure Software
related talks
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
37mThe State of Open Source Security
41mManaging the Risk of Software Supply Chain Attacks
30mSecure Open Source Practices
31mThe internet is broken: breaking down the software supply chain
25mTrusting Your Open-Source Software Supplier
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It