From Security Drift to Guardrails: Policy Enforcement for Open Source Supply Chains with Minder

Open source projects lose security posture through drift, not through dramatic failures. An unpinned GitHub Action gets silently updated to a compromised version, as happened with tj-actions/changed-files, and secrets leak across thousands of repositories before anyone notices. A branch protection rule gets disabled during a refactor and never restored. These gaps are rarely caught until they become incidents.

This talk introduces Minder, an OpenSSF project for policy-driven software supply chain security, and shows how it turns informal security checklists into continuously enforced policy. I will walk through enrolling a repository, applying the OSPS Security Baseline level-1 profile, and seeing how Minder detects drift like unpinned actions or disabled secret scanning in real time. I'll also cover Minder's GitLab provider support, which I contributed, and what it takes to extend policy enforcement beyond GitHub.

The talk closes with an honest look at where automated remediation helps maintainers and where it should stop, drawing on real friction points encountered while contributing to and using the project.

What security drift looks like in real open source repositories, with the tj-actions/changed-files incident as a concrete example

How the OSPS Security Baseline gives a practical, level-based framework for repository security posture

How to enroll a repository in Minder and apply a baseline profile in under a few minutes

What it takes to extend supply chain security tooling beyond a single git forge (GitHub to GitLab)

Where policy automation should assist versus where it should defer to maintainer judgment