Securing the open source Clearwater Health Systems consumes across 2,000 repositories: every npm, PyPI, Maven, Go and container component passes through the dependency funnel — charter, inventory, intake, triage, provenance, remediate, license and govern — ending in 1,980 fixes verified closed; malicious packages stopped before they run, including a one-character typosquat of Clearwater's own SDK, 14 typosquats, 3 dependency-confusion attempts and a 2.1-score abandoned library; and honest metrics that show the reachable backlog of 214 instead of a raw count of 1,840 CVEs.

CY-SENIOR-105Senior Level · Open Source Security

Open Source Security Program — The Dependency Funnel

A senior-level program course that secures an organization's own use of open source, deliberately and continuously, from charter through governance, across eight stages of the dependency funnel — charter, inventory, intake, triage, provenance, remediation, license, and governance.

16 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Charter the program's ownership split with OSPO and scope it to direct and transitive dependencies, containers, and AI models.
Build an automated, fleet-wide SBOM foundation with a central, queryable inventory, and gate intake with health scoring and provenance checks.
Triage vulnerabilities with multi-source feeds, EPSS/KEV, and reachability analysis, defending against malicious and compromised packages.
Track remediation to a verified close, clear license and export obligations, and govern the program with honest metrics and real continuity.

Price:৳10,000