Take Control of Your AppSec: Remediate Independently

Security teams scan for open source vulnerabilities constantly, yet backlogs keep growing. In this recorded session, Seal Security co-founder and CPO Alon Navon walks through why the standard fix, upgrading to the latest package version, is harder than it looks, and what backporting the original security fix does differently. The talk runs 44 minutes and includes a live product demo and audience Q&A.

Recorded: July 2024 · Length: 44 minutes · Speakers: Alon Navon (Chief Product Officer and Co-founder, Seal Security)

The core problem the session addresses is that a version upgrade rarely ships the security fix on its own. It usually arrives bundled with unrelated feature changes and breaking changes, on top of transitive dependency conflicts, end-of-life components, upgrade cascades across a dependency tree, and legacy code that was never built to run on a newer version. Each of those turns a one-line security fix into a multi-week engineering project, which is why vulnerabilities sit open long after a scanner has already flagged them.

Backporting takes a different path: copy the exact code from the upstream commit that fixed the vulnerability, apply it to the version already running in production, and rebuild. The session explains why this works for the overwhelming majority of cases and what Seal's team and tooling do to verify every patch before it ships.

Key findings from the session

A typical JavaScript vulnerability fix is only about six and a half lines of code. The vulnerability is rarely the problem; everything else bundled into a version upgrade is. Isolating just those lines and backporting them produces a fix without pulling in the rest of the new release.

Because a backported version is a fully compatible drop-in replacement, with the same major version and the same API as the one it replaces, developers do not need to change a single line of application code to adopt it. That is what lets security and DevOps teams remediate on their own, without waiting on an engineering team's sprint capacity.

Every backport Seal ships is tested twice: once by running the open source library's own full test suite against the patched version, and once by running the vulnerability's own proof-of-concept test to confirm the fix actually closes it. Automation handles most of this; Seal's research team uses LLMs to speed up harder cases, with human researchers verifying the result before anything ships. A straightforward patch takes under 30 minutes; a hard case can take a researcher up to three days.

Backporting scales. The session covers how Seal's coverage of vulnerable packages downloaded weekly from npm grew from 15% to well over 50% in three months. Backporting works for well over 90% of vulnerabilities across ecosystems, and for around 99% in C and C++. The exceptions are vulnerabilities tied to a broken feature, such as an outdated cryptographic algorithm, where the fix is a behavior change the application code has to account for rather than a drop-in patch.

Who this is for

This session is for security and DevSecOps teams carrying an open source vulnerability backlog they cannot clear through upgrades alone, and for engineering leaders who want to understand why "just upgrade it" keeps failing as a remediation strategy. It is also useful background for anyone comparing backporting with patch management or dependency-upgrade tooling, since it covers both how the approach works and where its limits are.

Chapters

• 00:05 Introduction: why open source vulnerabilities are still a problem
• 02:31 The existing vulnerability management workflow
• 05:31 Why upgrading to the latest version is so hard
• 11:14 What backporting security fixes means
• 13:30 How backporting enables security teams to remediate independently
• 20:30 Inside the backporting process and the role of LLMs
• 28:55 Coverage: scaling backporting across the npm ecosystem
• 31:42 Challenges and limitations of backporting
• 35:04 Getting remediated libraries into production: product demo
• 38:31 Q&A

Watch the session

Watch the full recording to see the backporting process explained end to end, including the product demo, or talk to the team directly.

Watch the full session · Book a demo