AI-Powered Open Source Risk Management: ISO Self-Certification Kit and 5-Level AI Coding Guide
summary
Trusted OSS is an open-source (CC BY 4.0) kit that uses nine AI agents (Claude Code) to auto-generate 24 compliance artifacts—OSS policy, SBOMs, vulnerability response procedures, training materials, and a conformance declaration—and installs ready DevSecOps pipelines (SAST, SCA, secret detection, IaC) into CI/CD. It presents a concrete five-level AI Coding Governance model that progresses from ad-hoc prompting to continuous automatic remediation (Level 5), and demos tools like Trusca SCA and BOMLens SBoM generator, which already produce usable SBOMs and policies.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:16Open source challenges
- 5:57ISO frameworks
- 8:24AI agents for policies
- 12:015-level AI coding model
- 13:48Level 1-2 AI rules
- 16:48Level 3 DevSecOps
- 19:00Level 4 vulnerability detection
- 22:12MCP security vulnerabilities
- 23:59Level 5 post-deployment scanning
- 24:42Compliance tools
- 27:18Demo: TruskA SCA
- 29:23Demo: BomLens SBOM
- 32:15Summary
related talks
21mNavigating the Intersection: AI’s Role in Shaping the Secure Open Source Software Ecos...
33mORT Automate compliance using Open Source & InnerSource
24mLicense compliance with AI assisted coding
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...
30mContinuous Compliance in Open Source: Safety Assurance Through S...
38mOpen Source Licensing in the Era of AI-Assisted Coding
28mScalable Security and Compliance in the Age of AI
43mBoF: Open Source & AI: Where OSPOs Make It Work