Is Your Code Secure?: Automatic Security Analysis Tools and Systems
summary
Samsung builds an automated security pipeline that scans commits and stored code for known CVEs and secrets, using an NVD-derived DB plus line-based patch detection to match vulnerable code even when versions change; a credential scanner that finds API keys and passwords (many found in public repos); and automated fuzzing that reuses unit tests to generate harnesses and find crashes. The system runs continuously, auto-reports fixes to developers, claims higher accuracy than off‑the‑shelf tools, and responds to the industry trend of >16,000 reported vulns while leveraging >90% unit test coverage.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:02Background
- 8:02Why do we need to detect CVE automatically?
- 17:08Credential Scanner
- 24:37Our Approach for Fuzzing
- 26:02Automated Fuzzing
- 29:17Security Development Life-cycle
- 31:44Concluding Remarks
related talks
42mSecure or Insecure Code, That Is the Question
33mSecurity as Code: A DevSecOps Approach
52mSecurity as Code: A DevSecOps Approach
42mContinuous Security: Integrate security tools into your DevOps Pipeline
43mApplication Security is a Community Effort
59mSecurity as Code: A DevSecOps Approach
39m5 Open Source Security Tools All Developers Should Know About
07mInterview