What Have We Found in Git Repos? - Security Analysis of Open Source Repositories

Explore how open source project repositories inadvertently expose security vulnerabilities through Git commit histories in this 39-minute conference talk. Learn about research findings that reveal how fix commits in public repositories often hint at security issues days or weeks before official advisories are published. Discover practical strategies for maintainers to reduce information leakage and better protect their projects and users from premature vulnerability exposure. Examine real examples from high-impact open source projects that demonstrate how careful analysis of Git histories can uncover traces of security fixes before they become public knowledge. Gain insights into the unintended consequences of transparent development practices and understand methods to maintain security while preserving the benefits of open source collaboration.