OpenSSF Community Day Europe 2026

The open source ecosystem faces a Vulnpocalypse as AI-driven vulnerability reports surge. While potentially beneficial for security long-term, the current volume threatens to overwhelm open source projects. Maintainers work at human speed, and each report requires careful attention, verification, and disclosure.

So we need machines to help fix what the machines are finding.

In this workshop.we will walk through OSS-CRS. It's an OpenSSF project that gives us a standard orchestration framework for Cyber Reasoning Systems (CRS) capable of finding, proving and patching vulnerabilities.

Beyond the technology, we examine critical best practices for CRS usage. This includes how to build community norms that respect a maintainer's time instead of just dumping more work on their plate.

Attendees will learn:
- The current trends of AI-generated reports and the impact on open source
- How to run OSS-CRS for bug finding and fixing.
- Best practices for responsible use of AI tools in CVD.