We used Kolega to find and fix real security holes in open source projects that are of high quality.

We wanted to test the platform against real-world codebases instead of fake ones while building Kolega.dev.

So we started scanning a number of well-maintained open source repositories and seeing how the platform dealt with real security problems.

What we found was interesting:

Even in well-maintained high-quality projects, security scanners can find problems that are hard to quickly sort through because:

• findings don't say where the vulnerability came from

• Many alerts often point to the same problem.

• It's not always clear what the right fix should look like

With Kolega, we were able to find real vulnerabilities and come up with fixes that could be reviewed as pull requests.

We have been writing down these examples in a series called "Security Wins," where we explain:

• what the weakness was

• why it was important from a security point of view

• how the platform figured it out

• what the fix looked like

The point is to show real examples of security problems being fixed in real life, not just theoretical scanning results.

If you want to see some of the cases we've written about so far:

https://kolega.dev/security-wins/

I'd also like to hear from other people who work in AppSec or DevSecOps. How often do you find security holes in open source projects that are otherwise well-maintained?