OpenSSF Courses

Managing Vulnerabilities in Open-Source Dependencies

Learn strategies to secure open-source dependencies, evaluate software composition analysis tools, and shift from reactive to proactive security postures in product development.

• YouTube
• 13 minutes
• Self-Paced
• Free Video

Automated End-to-End VEX Streams You Can Trust

Explore automated VEX streams for trusted vulnerability communication. Learn to build end-to-end systems using OpenVEX, enhancing software security without human intervention.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Secure Coding Guide for Python

Learn secure coding practices for Python, focusing on CWE framework-based advice and executable examples to enhance open source project security and developer skills.

• YouTube
• 18 minutes
• Self-Paced
• Free Video

Securing GenAI End-to-End: From Development to Deployment

Explore comprehensive strategies for securing AI-powered applications throughout the software supply chain, from data ingestion to model deployment and output protection.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Breaking Barriers: The Art of Gamified Security Training

Explore gamification in security training through a successful open-source game. Learn strategies to enhance developer engagement, ownership, and communication in code security.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Userspace CNI - Developing in the Open While Remaining Secure

Explore the process of reviving and securing an unmaintained Kubernetes networking CNI using OpenSSF scorecard, with insights on implementing CI and improving open-source development practices.

• YouTube
• 15 minutes
• Self-Paced
• Free Video

Nation-State Threats in the Open-Source Software Supply Chain

Explore North Korean cyber threats targeting software developers through malicious npm packages, focusing on Lazarus Group campaigns and their evolving tactics to steal cryptocurrency.

• YouTube
• 16 minutes
• Self-Paced
• Free Video

Exploring a Risk Approach to Software Supply Chain Security

Explore software supply chain security through a risk-based approach, focusing on open source vulnerabilities and process improvements to mitigate supplier risks.

• YouTube
• 18 minutes
• Self-Paced
• Free Video

Rules of Engagement for Forking a Dependency

Explore guidelines for forking dependencies when facing security vulnerabilities, balancing community responsibility with timely fixes.

• YouTube
• 11 minutes
• Self-Paced
• Free Video

The Power of Gamification in Security Training

Explore how gamification transforms security training, enhancing engagement and retention through hands-on challenges, real-world scenarios, and instant feedback.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Let Devs Be Devs Without Sacrificing Security

Explore flexible, secure CI pipelines using Tekton, Chains, and Enterprise Contract to balance developer innovation with robust security measures for various software targets.

• YouTube
• 18 minutes
• Self-Paced
• Free Video

SLSA: A Security Paradigm for Software Supply Chain Integrity

Explore SLSA levels, software supply chain security basics, and tools like Cosign to enhance artifact integrity and benefit your organization.

• YouTube
• 58 minutes
• Self-Paced
• Free Video

Proactive Supply Chain Security with GUAC

Explore GUAC, a tool for proactive software supply chain security. Learn about its features, recent release, roadmap, and how to contribute to this OpenSSF project.

• YouTube
• 58 minutes
• Self-Paced
• Free Video

Improving Posture of Critical OSS Projects with Security Audits

Explore effective security audits for open source projects, including top vulnerabilities, lessons learned, and common mistakes to avoid. Enhance your OSS security posture.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Community Engagement and Security Initiatives: Examples from Python and Rust

Explore Python and Rust Foundations' security initiatives, focusing on community engagement, consensus building, transparent communication, and addressing pushback for better open-source security practices.

• YouTube
• 23 minutes
• Self-Paced
• Free Video