Session Description

This presentation will describe in detail the process of acquiring, designing, and executing a security audit on Scala. A project of this size and impact requires specific, nuanced security efforts beyond the capabilities of day-to-day operations. By introducing a skilled, experienced security team with a specific scope to the code, OSTIF created a custom security audit that created meaningful outcomes for the scala organization and project. As our ecosystem experiences unprecedented supply chain attacks and hacks, thoughts have turned to how the open source community can address and prevent exploits.

First, our presenter will go over the process of creating an audit, how funding was sourced and stakeholders brought in. Then, the steps to selecting the audit team and determining the scope of work will be discussed, as well as the best security practices a project can perform especially ahead of formal security engagements. Using direct examples from our Scala audit of 2025-2026, OSTIF will show how an audit team directly collaborates with project maintainers to refine and specify their work to Scala’s needs and functions. Moving forward, the presentation will show the issues identified by the work and the steps taken by the Scala team to fix or address them as they move forward in development. Attendees will walk away with the knowledge of how a security audit works, what it does to a project in the short and long term, and a desire to contribute to Scala’s ongoing security and development.