Scaling the Security Researcher to Eliminate Open-Source Vulnerabilities
Dan Kaminsky Fellow Jonathan Leitschuh shares automated bulk-remediation frameworks using CodeQL to fix thousands of vulnerabilities across open-source ecosystems.
Summary
The Asymmetry of Open-Source Vulnerability Remediation
Every year, thousands of developer hours are spent discovering identical classes of known vulnerabilities (e.g. zip slips, temp file flaws) across disparate open-source repositories.
Automating Bulk Discovery with CodeQL
Jonathan Leitschuh demonstrates writing semantic CodeQL queries to identify structural security flaws across hundreds of thousands of public GitHub repositories.
Orchestrating Mass Pull Requests and Coordinated Fixes
Leitschuh explains building automated tooling (OpenRewrite, GitHub API scripts) to generate, submit, and track thousands of automated security pull requests.
Cultivating a Scalable Fix-First Security Paradigm
The author advocates for shifting security research incentives from purely publishing CVEs to building automated, ecosystem-wide remediation engines.
Related talks
App Sec Village·19 min
Gregg Horton · Ryan Slama
Explores risks, security challenges, and visibility issues in deeply nested open-source software dependencies.
Main Stage·34 min
Ji'an Zhou · Ying Zhu · ZiYang Li
Reveals critical architectural and deserialization vulnerabilities across Apache Kafka client and server implementations, enabling remote code execution.
App Sec Village·57 min
Vandana Verma Sehgal
Shares strategies for building and scaling an effective enterprise application security program using open-source tools.