Application Security is a Community Effort
summary
Claim: open source accelerates detection and remediation by letting many eyes vet code — transparency exposed the XZ backdoor and sped fixes. GitLab composes scanners using OWASP ZAP, Trivy, GitLeaks (plus Semgrep and custom rule sets), runs an open integration framework and advisory DB, and absorbs community contributions (over 2,000 external contributors); a grocery chain added a mobile app scanner that now runs in pipelines. Main risks are sustainability and quality control (strict commit formats, tests, review limits).
AI-written summary · about
chapters (19)
- 0:00Application security intro
- 1:04Open source security benefits
- 3:29Transparency in open source security
- 5:37Sustaining open source communities
- 6:18Cost savings with shared security tools
- 8:06Collaboration in security innovation
- 10:34Security learning resources
- 12:21Open source security scanners
- 15:13Getting started with contributions
- 17:00Threat modeling basics
- 18:23Vulnerability disclosure process
- 20:07Vulnerability life cycle
- 21:53Remediation costs in development
- 22:55Quality control in open source
- 24:00Sustaining open source projects
- 26:14GitLab’s open source model
- 28:19Community-driven development
- 31:35Security tools integration framework
- 32:58Summary and Q&A
related talks
05mApplication Security is a Community Effort
43mSponsored Session: Application Security is a Community Effort
52mApplication Security at DevOps Speed and portfolio scale
19mApplication Security at High Velocity
38mFinding Security Issues in Open Source
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
47mSecurity is Everybody's Job