Author: GitHub - Bewertung: 7x - Views:40
In this episode guest host, Greg Cochran, from the GitHub Secure Open Source Fund brings together four maintainers who are helping secure the open source projects we all depend on: Christian (Log4j/Log4Shell), Carlos (GoReleaser), Michael (EVCC), and Camila (ScanAPI) to unpack what it really looks like to level up security in critical OSS.
They share how the Fund’s three-week security sprint, ongoing check-ins, and tight-knit community helped them move from “we don’t know what we don’t know” to concrete wins: hardened GitHub Actions pipelines, incident response plans, better reporting processes, and SBOMs that actually include dependency licenses. They also talk candidly about asking “dumb” questions in a trusted space and the ripple effect when one project’s security posture improves across its dependents. Finally, the group dives into AI security: using fuzzing, GitHub Copilot, and tools like the Secure Code Game both to find vulnerabilities faster and to keep up with attackers who now have AI on their side too.
Links mentioned in the episode:
https://github.com/open-source/github-secure-open-source-fund
https://github.blog/news-insights/company-news/announcing-github-secure-open-source-fund/
https://github.blog/open-source/inside-the-breach-that-broke-the-internet-the-untold-story-of-log4shell/
https://www.youtube.com/watch?v=t74ClffSUW0
https://evcc.io/
https://github.com/goreleaser/goreleaser
https://scanapi.dev/
https://securitylab.github.com/
https://github.com/skills/secure-code-game
https://github.com/features/copilot
The GitHub Podcast is hosted by Abigail Cabunoc Mayes, Kedasha Kerr and Cassidy Williams. The show is edited, mixed and produced by Victoria Marin. Thank you to our production partner, editaudio.
— CHAPTERS —
00:00 - Intro: the secure open source fund
01:04 - Meet the maintainers (Log4j, GoReleaser, EVCC, ScanAPI)
03:17 - How the fund improved security (Log4j)
04:52 - Asking "dumb" questions in a safe space
06:18 - Hardening pipelines and adding SBOMs
07:24 - The power of community in security
15:44 - Improvements made to the projects
22:09 - AI security: fuzzing and Copilot
27:50 - Stand out things from the program
Stay up-to-date on all things GitHub by subscribing and following us at:
YouTube: http://bit.ly/subgithub
Blog: https://github.blog
X: https://twitter.com/github
LinkedIn: https://linkedin.com/company/github
Instagram: https://www.instagram.com/github
TikTok: https://www.tiktok.com/@github
Facebook: https://www.facebook.com/GitHub/
About GitHub:
It’s where over 180 million developers create, share, and ship the best code possible. It’s a place for anyone, from anywhere, to build anything—it’s where the world builds software. https://github.com