whoami.sh
$ whoami
Bharath Pedada
role:
Assoc Security Engineer
[ Penetration Tester ]
# I break things to understand how they can be built better.
🛡
$ what_i_do
$ currently_exploring
$ my_playground
Burp Suite
Nmap
Python
Linux
Git
Cloud
$ outside_terminal
Music
Video Editing
Building things
Breaking things
$ trace --what-i-break
Web Apps
APIs
Networks
Security Controls
INTRODUCTION
01
Open Source Tool Evaluation
Automated Risk Evaluation
Input
Tool name / repository URL
Output
Security-focused risk assessment + report
11 / 25
Open Source Is Everywhere
Start with reality, not vulnerabilities.
Developer Tools
Security Tools
CLI Utilities
Libraries
Frameworks
Monitoring Tools
Database Tools
DevOps Utilities
Productivity Software
Open source has become part of the infrastructure we depend on. But how much do we actually know about what we’re using?
02 / 25
Why Do We Use Open Source / Freeware?
Cost efficiency
Faster development
Community support
Existing functionality
Faster deployment
Customization
Large ecosystem
Developer familiarity
Open source is incredibly valuable. The challenge is knowing what we’re trusting.
04 / 25
Open Source ≠ Automatically Trusted
Open Source
Source code is available for inspection, modification and redistribution under its license.
Freeware
Software is available to use without a purchase cost, but the source code may not be available.
Free to use
≠ Free from risk
Source available
≠ Automatically secure
03 / 25
Watch This Happen
07 / 25
The Trust Problem
“Use this tool. It’s open source.”
Who maintains it?
Is the repository legitimate?
Is it still maintained?
Does it contain vulnerabilities?
Are its dependencies vulnerable?
What happens during installation?
What permissions does it require?
Does it download anything?
Is the project abandoned?
Is the license appropriate?
That’s already a security assessment. We often perform these checks manually.
05 / 25
What Do We Usually Do?
Someone
recommends a tool
Search
Find GitHub
repository
Check stars
/ forks
Look at last
commit
Check
CVEs
Run a
scanner
Read
documentation
Make a
decision
How consistent is this process?
06 / 25
The Typical Evaluation
01
Project
Is the project legitimate and maintained?
02
Security
Does the code contain vulnerabilities?
03
Dependencies
Are third-party components vulnerable?
04
Supply Chain
What happens when we install it?
05
Compliance
Can we legally and organizationally use it?
06
Operations
What does it require at runtime?
Risk is multidimensional.
08 / 25
The Problem With Individual Checks
GitHub Stars
10,000 stars
≠
Secure
Recent Commit
Recently maintained
≠
Vulnerability-free
No CVEs
No CVE
≠
No vulnerability
Clean SAST Scan
No code finding
≠
Safe dependency chain
Popular Project
Popular
≠
Appropriate for your org
Open Source
Transparent
≠
Automatically trustworthy
No single signal is enough to make a security decision.
09 / 25
Where the Traditional Approach Breaks
GitHub
NVD
OSV
Virus Total
Dependency
Check
EPSS
Manual
Review
Documentation
Hybrid Analysis
The problem isn’t a lack of security tools. The problem is connecting the signals.
10 / 25
Introducing
OSTE
Automating Open Source Security Risk Evaluation
From a GitHub URL to an actionable risk assessment
GitHub Repository
OSTE
Risk Assessment
01 / 25
OSTE brings multiple dimensions of open-source evaluation into a single automated workflow.
OSTE’s Workflow
Discover
Understand the project and its ecosystem.
Evaluate
Analyze security, dependencies, trust, maintenance and operational risks.
Decide
Convert the findings into an actionable risk decision.
12 / 25
How OSTE Actually Works
→ data flow
Sources / Inputs
Tool Name / URL
GitHub URL
Tool Name (freeware)
Route
Identify Type
Users
Web UI / CLI
OPEN SOURCE FLOW
(Source Code Available)
1. Repository
Collection
GitHub API
2. Project
Analysis
Health · Contributors · Commits · License
3. Dependency Vuln.
Analysis
OSV
4. Vulnerability
Intelligence
NVD · EPSS API
5. Web Search for
Known Vulnerabilities
NVD / OSV / Google
FREEWARE FLOW
(Source Code Usually Unavailable)
1. File / Installer
Collection
cURL / Wget
2. Publisher &
Reputation Analysis
VirusTotal
3. Behavior &
Content Analysis
Hybrid Analysis
4. Web Search for
Any Vulnerabilities
NVD / OSV / Google
DATA AGGREGATION
Normalize · Deduplicate · Map to CVE / CVSS / EPSS schema
AI RISK ASSESSMENT
LLM Analysis (Groq) · Contextual Correlation · Dynamic Scoring
REPORT GENERATION
Summary · Findings · Risk Score · Recommendations · Final Decision
DATA SOURCES & INTEGRATIONS
GitHub API
OSV
NVD
EPSS
VirusTotal
Hybrid
Analysis
7-Zip
14 / 25
What Does OSTE Actually Evaluate?
Authenticity & Trust
Repository legitimacy and source credibility.
Project Health
Maintenance, contributors, releases, activity.
Security
Direct vulnerabilities and code-level findings.
Dependencies
Known vulnerabilities in third-party components.
License & Compliance
License information and usage considerations.
Installation
Installation behavior, scripts, permissions.
Risk Intelligence
Severity, exploitability and contextual risk.
ACT 3 — OSTE
13 / 25
Security Findings ≠ Risk
Critical
High
Medium
13 findings total
2
Critical
4
High
7
Medium
Is the tool automatically unsafe? Not necessarily.
Is the vulnerable component actually used?
Is the vulnerable functionality reachable?
Is exploitation realistic?
Is the issue relevant to the deployment environment?
Is there an available fix?
How severe is the exposure?
OSTE moves from finding collection → risk interpretation.
15 / 25
FROM FINDINGS TO DECISION
Example Evaluation
LIVE DEMO
1.
Repository Analysis
✓
2.
License Analysis
✓
3.
Git Security
3 findings
4.
Dependency Analysis
5 vulnerabilities
5.
NVD
7 CVEs
6.
EPSS
Risk context
7.
AI Analysis
✓
FINDINGS BY SOURCE
One real example is more valuable than many architecture slides.
19 / 25
BIGGER PICTURE
OSTE in Production
How this actually runs inside our org today — and where it’s headed.
LIVE
Current State — Harness Pipeline
Trigger Input
Tool name / URL
Harness Pipeline
CI/CD run
OSTE Engine
Full evaluation
Report Generated
PDF / JSON
Org Storage
Available to team
PLANNED
Next — Teams Bot
Chat Message
Type in Teams
Bot Triggers Pipeline
No manual setup
OSTE Engine
Same evaluation
Report in Chat
Instant reply
23 / 26
BIGGER PICTURE
We don’t just consume open source.
We inherit its risk.
Code Risk
Dependency Risk
Supply-Chain Risk
Operational Risk
Compliance Risk
Open-source adoption should be an informed security decision, not just a download.
24 / 25
OSTE
From "Can I download it?" to "Can I trust it?"
Open Source Tool Evaluation
Questions?
25 / 25
25 / 25
S C A N H E R E