WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

Reviewing 3rd party library security easily using OpenSSF Scorecard

Niels Tanis

Nearly 80% of developers ignore library updates. This blind trust invites devastating supply chain attacks. Learn how OpenSSF Scorecard acts as an automated nutrition label for open-source repositories.

Pause
Mute Enter Fullscreen
#1 about 2 min

Understanding the security risks of third-party libraries

How modern application architectures are fundamentally vulnerable to unmaintained or malicious dependency components.

#2 about 3 min

Managing dependency vulnerabilities and transitive software risks

How stale open-source dependencies and complex transitive trees contribute to hidden application vulnerabilities.

#3 about 3 min

Combatting rogue maintainers and backdoors in open source

How threat actors gradually infiltrate open-source projects to plant malicious code and subtle backdoors.

#4 about 2 min

Addressing visibility challenges with software nutrition labels

The need for clear software composition visibility to expose hidden unmanaged libraries within compiled packages.

#5 about 8 min

Assessing repository security hygiene using OpenSSF Scorecard

An overview of automated repository checks spanning known vulnerabilities, branch protection, testing, and continuous integration practices.

#6 about 2 min

Evaluating dependencies locally and through automated scorecard APIs

How to generate and parse JSON scorecard reports for dependency trees using command-line tools and programming interfaces.

#7 about 4 min

Correlating OpenSSF scorecard metrics with real vulnerability data

Analyzing industry data to understand how contributor counts and defined security policies correlate with project vulnerabilities.

#8 about 4 min

Exploring advanced security tooling and community dependency vetting

Improving software ecosystem safety using coverage-based fuzzing, contextual data-flow analysis, reproducible builds, and collaborative vetting.

Matching moments

2:09 min

Evaluating library intent using security scorecards

Niels Tanis Niels Tanis · WWC 2022

2:46 min

Mapping the complete software supply chain attack surface

Matthew Brady Matthew Brady · WWC Europe 2026

1:39 min

Summarizing strategies for securing the open source ecosystem

Joseph Katsioloudes Joseph Katsioloudes · WWC 2025

3:00 min

Utilizing static analysis for foundational source code security

Michael Wildpaner Michael Wildpaner · WWC 2025

1:41 min

Leveraging free tools for application security auditing

Stefania Chaplin · WWC 2022

2:00 min

Mitigating risks from supply chain attacks and vulnerable libraries

Jasmin Azemović Jasmin Azemović · WWC 2023

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
10 months ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
almost 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
almost 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Dapr in Practice thumbnail
24:08
almost 2 years ago

Dapr in Practice

marcklefter

Minimising the Carbon Footprint of Workloads thumbnail
27:46
almost 2 years ago

Minimising the Carbon Footprint of Workloads

Michael Mueller

Upcoming sessions on this topic

Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

GitHub’s Team X-Ray: Your Repository Knows More About Your Team Than Your Team Does

Andrea Griffiths

Senior Developer Advocate

Andrea Griffiths
Open session

World Congress 2026 North America

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg

Related videos

Securing your application software supply-chain thumbnail
28:27
WWC 2022 • about 4 years ago

Securing your application software supply-chain

Niels Tanis

Real-World Security for Busy Developers thumbnail
29:50
WWC 2025 • 12 months ago

Real-World Security for Busy Developers

Kevin Lewis

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

How GitHub secures open source thumbnail
25:28
WWC 2025 • 12 months ago

How GitHub secures open source

Joseph Katsioloudes

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor thumbnail
42:55
Coffee With Developers • over 2 years ago

Coffee with Developers with Feross Aboukhadijeh of Socket about the xz backdoor

Feross Aboukhadijeh

Maturity assessment for technicians or how I learned to love OWASP SAMM thumbnail
1:41:05
LIVE • over 4 years ago

Maturity assessment for technicians or how I learned to love OWASP SAMM

Mathias Tausig

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.