> Markdown version of [/events/world-congress-2024/sessions/378-reviewing-3rd-party](https://www.wearedevelopers.com/events/world-congress-2024/sessions/378-reviewing-3rd-party). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Reviewing 3rd party library security easily using OpenSSF Scorecard


- **Date:** Friday, Jul 19, 2024
- **Time:** 13:40–14:10 (30 min)
- **Room:** STAGE 4 (500)
- **Event:** World Congress 2024

## Recording

[Watch recording](https://www.wearedevelopers.com/videos/1041-reviewing-3rd-party-library-security-easily-using-openssf-scorecard)

## Description

Several studies shown that round 80% of our applications consist of other people's code. With using any 3rd party package (e.g. NPM, Maven, Cargo, NuGet, PyPi) that is developed by others, we also put a lot of trust in it, which might result in bigger security problems later. 
Would it not be nice if there is a better way to review a package for security? An easier way to perform an assessment based on certain aspects of the package that will tell you more about the package its software security. With the introduction of Scorecard project the Open Source Security Foundation (OpenSSF) exactly tries to achieve that. 
In this session we start out with different area's covered by of OpenSSF Scorecard, like how well it's maintained, does the build have dangerous workflows, and does the project use other security tools to check for problems?. All combined will give us the ability to assess a 3rd party package its security posture more easily and improve our own application security.

## Speaker

### [Niels Tanis](https://www.wearedevelopers.com/@niels-tanis)

Sr. Principal Security Researcher at Veracode | Microsoft MVP


## Related talks at this congress

- [Supply Chain Security - Strategies and Best Practices](https://www.wearedevelopers.com/events/world-congress-2024/sessions/271-supply-chain) — Hendrik Ebbers
- [Open Source Secure Software Supply Chain in action](https://www.wearedevelopers.com/events/world-congress-2024/sessions/127-open-source-secure) — Natale Vinto
- [How Can My Software Development Be 'Secure by Design'?](https://www.wearedevelopers.com/events/world-congress-2024/sessions/295-how-can-my-software) — Christoph Niehoff
- [Are Code Reviews Worth It? Insights from 16 Years of Review Data](https://www.wearedevelopers.com/events/world-congress-2024/sessions/51-are-code-reviews) — Sven Amann