OpenSSF Community Day North America 2026

There's a million security tools, specifications, formats, models, schemas, and the list goes on. The problem of keeping up to date on security best practices seems insurmountable even for experienced practitioners. The problem is even worse for your average open source developer who wants to focus on features, not integrating the latest security and compliance tooling.

In this talk you'll how AI can be utilized to integrate with existing open source security validation tools like OpenSSF Scorecard, Privateer, Minder, and then use the data from that along with the context of a project to enable AI guided remediation.

This talk will introduce Darnit, a framework for architecting and implementing this pattern. It is an MCP/Agentic framework that:
1. Loads controls and context about a project
2. Runs an audit utilizing deterministic and heuristic tools
3. Gathers context not found in the audit and confirms with user about anything not clear and stores it.
4. Re-audits
5. Automatically remediates any issues discovered, and falls back to manual suggestions where it can't.