The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The Apache Software Foundation (ASF) reported running full security scans across 230 repositories in a three-day window in August 2026. The effort combined ASF Tooling’s automated audit pipeline with separate scans using Anthropic’s Project Glasswing harness, while ASF Security prepared reviewed threat models and routed findings through the Foundation’s disclosure process. The work was still in progress when the ASF case study was published on September 3, 2026: it did not give final totals for confirmed vulnerabilities, fixes, or CVEs.
What “foundation-scale” scanning means in the ASF case
Scanning a project on demand can leave most projects waiting. The ASF case study describes a shift toward a managed service that could assess many repositories using repeatable tooling, project-specific context, and an established security disclosure path.
As an Amazon Associate I earn from qualifying purchases.
The scale figures describe different parts of the effort and should not be conflated: ASF reported scans across 230 repositories during a three-day window in August 2026. Separately, 75 Project Management Committees (PMCs), representing more than 180 repositories, signed up to develop threat models. Those figures do not establish that every scanned repository had a reviewed threat model.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The ASF case study, authored by ASF Tooling and ASF Security and originally published on The ASF Blog on September 3, 2026, presents the effort as ongoing work rather than a completed vulnerability-remediation campaign.
#1 Best Overall
Two systems, with different jobs
The effort involved two related but distinct scanning approaches. ASF compared its existing audit pipeline with Project Glasswing on the same repositories to learn how each performed and tune its scanning work; Glasswing was not the ASF pipeline itself.
ASF Tooling’s automated audit pipeline
ASF Tooling says it had operated an automated audit pipeline since early 2026. The pipeline evaluates code against the OWASP Application Security Verification Standard (ASVS) and runs on Gofannon, an agent platform developed by the Tooling team. It was first used for Apache Trusted Releases, a release-management platform, before the team expanded its role toward a managed scanning service for ASF projects.
Projects could define what they wanted scanned and run the process through a browser or API without supervision. A project could also supply audit guidance covering its security posture, architecture, coding standards, and deployment choices. ASF Tooling says this context reduced false positives and incorrect inferences in final reports; the case study does not provide an independent measurement of that reduction.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteProject Glasswing’s scans
ASF joined Anthropic’s Project Glasswing for security research. The reported setup used the Glasswing harness in parallel Claude Code sessions against Mythos 5, with simple initiating prompts and no customization of the harness. The case study says findings included critical vulnerabilities with drafted patches that were reviewed separately. It does not publish an aggregate finding count or say that every finding was confirmed or fixed.
How the ASF pipeline divides the work
The pipeline uses three configurable model tiers, assigning different work to each rather than asking one model configuration to handle every step.
| Tier | Purpose described by ASF |
|---|---|
| Light | High-volume filtering |
| Medium | Building inventories of code contents |
| Heavy | Analysis requiring more reasoning |
The case study lists an Opus/Sonnet/Haiku model ensemble and a Mythos/Gemma/Qwen ensemble. In the latter setup, the two lighter tiers used self-hosted models. ASF says model combinations can be swapped without changing the pipeline, allowing the team to balance quality, speed, and cost. These are configurations described in the case study, not a claim that one combination is universally preferable.
Why reviewed threat models mattered
Before scanning, ASF Security invited interested projects to describe security-relevant components, trust boundaries, assumptions, and areas they did not want repeatedly re-evaluated. A threat model can explain what the project considers trusted by design, what it leaves to an operator, and which parts of the system are in scope for scrutiny.
A Threat Model skill contributed by Alpha-Omega helped create initial models and support communications with PMCs. ASF Security reviewed each model for correctness and applicability to the code before using it downstream. This review made the model project context for the scan, rather than an unchecked substitute for examining the code.
ASF reported that scanning against a reviewed threat model cost roughly one-fifth less than scanning without one. That is the ASF team’s estimate from this effort, not an independently validated or generally applicable benchmark. The case study attributes the difference to focusing analysis on consequential areas and avoiding repeated rediscovery of documented decisions; it does not provide a full cost accounting.
How findings were disclosed and prioritized
Findings went through ASF’s official disclosure path. Sensitive reports were sent first to the affected project’s security or private list, after which the PMC assessed significance and decided on remediation timing. This kept responsibility for project decisions with the project’s maintainers.
The reported process also considered deployment context rather than relying on a severity label alone. A finding’s practical priority depends on how software is used and exposed, as well as on the technical issue itself. The case study does not publish a final validation rate, total remediation count, or CVE tally, so the scan count should not be read as a count of confirmed vulnerabilities.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How this fits other foundation security programs
Foundations support security in different ways, and their services are not interchangeable with source-code vulnerability scanning. The Linux Foundation’s security resources describe LFX as providing project stakeholders automated scans and fix recommendations, CNCF as supporting third-party security audits and encouraging fuzzing for projects with high code complexity, and FINOS as providing ongoing security scanning for its projects. These descriptions are examples of separate programs, not an independent evaluation of the ASF effort.
Best Value
OpenSSF Scorecard is another complementary tool: it assesses repository security practices such as maintenance, dependency pinning, and code review before merge. Its August 28, 2023 v4.12 announcement documented GitLab support and continuous monitoring through GitLab CI/CD. That is a version- and date-specific announcement, not evidence of current compatibility. Scorecard’s repository-practice assessment is distinct from a source-code vulnerability audit or the ASF’s Glasswing scans.
What the ASF case study establishes—and what remains open
- Established: ASF reported scanning 230 repositories in a three-day window in August 2026, and 75 PMCs with more than 180 repositories signed up for threat modeling.
- Reported, not independently benchmarked: the roughly one-fifth lower scanning cost associated with reviewed threat models, and the reduction in false positives and incorrect inferences attributed to project-specific guidance.
- Not reported as final results: counts of confirmed vulnerabilities, fixes, CVEs, validation rates, or completed remediation.
- Described as planned: incremental scans, additional scan types, and project self-service using a Foundation-managed token budget.
For anyone assessing a foundation-scale program, the useful questions are what projects and repositories it covers, whether scanning is managed or on demand, what type of analysis it performs, how project context is reviewed, who validates and receives findings, and how scan frequency and fixes are managed. The ASF account offers detail on context and disclosure, but does not yet provide a recurring scan cadence or a final remediation ledger.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
