Apache scanned 230 repositories with AI - and the threat models did the heavy lifting

Over three days in August, the Apache Software Foundation ran full AI security scans across 230 of its repositories — and the interesting part is not the model, it is the plumbing. Seventy-five Project Management Committees first wrote a threat model for their own code: what is trusted by design, what is delegated to whoever operates the software, and what is explicitly out of scope. ASF Security reviewed every one before it fed anything downstream. Anchoring each scan on a reviewed threat model cut the cost of scanning by roughly a fifth, because the analysis stopped rediscovering documented design decisions. Findings went out through the Foundation's normal disclosure path — private security lists first, PMC assesses, maintainer remediates on their own timeline — and reports were ordered by what a maintainer should deal with soonest given how the software is actually deployed, not by severity label alone. Alongside the Anthropic-supplied Glasswing runs, ASF Tooling ran its own OWASP ASVS audit pipeline over the same repositories and compared results, which is how the Glasswing scans were tuned. The stated motivation is defensive: AI-generated vulnerability reports are already arriving at open source projects faster than volunteers can triage them, so the Foundation would rather run the scanning itself, with context, than sort other people's output. Next up is incremental scanning that remembers prior results, more OWASP scan types, and self-serve scanning against a Foundation-managed token budget. The transferable lesson for anyone pointing a model at their own codebase: the threat model is the product. Context is what separates a useful finding from noise.

This is a summary by our content curator. Read the original at The ASF Blog: https://news.apache.org/foundation/entry/security-scanning-at-foundation-scale.