SCORE Bot: Shift Left, at Scale!
summary
SCORE Bot automates PayPal’s PR security gate by hooking into GitHub Pull Request payloads, running custom static/semantic checks (about 25 checks) and posting contextual comments with step‑by‑step remediation and docs; it integrates with DevRunner and CI/CD containers, disables the merge button with a waiver flow for emergencies, and reports metrics across ~4,000 developers and hundreds of daily deployments—performance goal is runs in <1 second and deployed data shows findings trending down after rollout; A/B testing guides messaging and rules, and open sourcing is planned.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:35Secure Product Life Cycle
- 3:25Secure Product Landscape
- 8:30Developer Friendly
- 14:30Enforcement with Empathy
- 15:55Disclaimer
- 16:30Demo
- 25:30Questions
related talks
01h 02mProductivity Bots
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
38mAutomating repetitive communication tasks with a bot
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
38mSOBO: A Feedback Bot to Nudge Code Quality in Programming Courses
16mFortify Your Code: Secure Your Supply Chain with Scorecard
01h 01m"Looks Good to Me": A Practical Guide to Handling AI-Generated Code
36mSecuring the software supply chain