Trusted OSSTrusted OSS

AI-Powered Open Source
Risk Management

An ISO self-certification kit,
and a 5-level model for governing AI coding

Haksung Jang Open Source Program Manager, SK Telecom
Ambassador, OpenChain Project
Open Source Summit Korea 2026
August 12, 2026 · Rose
trustedoss.github.io/en · CC BY 4.0
The problem

What changed

Three shifts, and the gap each one opened

trustedoss.github.io/en
The problem 1 of 3

Supply chain attacks keep happening

2024
XZ Utils
A backdoor planted in the upstream project, after two years of earning trust
2021
Log4Shell
One library. Hundreds of millions of systems. No malice at all
Different causes, the same failure — nobody knew which product had the library inside. Working out the blast radius took days on its own
trustedoss.github.io/en/docs/overview/supply-chain
The problem 2 of 3

The bar went up. The means did not.

Reporting Sept 11, 2026
EU CRA
Full application follows on December 11, 2027
Published July 29, 2026
CISA 2026
Replaces NTIA 2021. Every transitive dependency, not just the top level. Hashes and licenses required. Scope reaches AI software and SaaS
The problem is not that suppliers cannot produce an SBOM. They produce one, and it still falls short.
cisa.gov · 2026 minimum elements for an SBOM
The problem 3 of 3

AI coding changed three conditions

Intake

The agent installs what it suggests. A human sees the name after it is in the code.

Review density

Output grows several times over. Reviewer headcount stays exactly where it was.

Tool calls

An MCP tool description enters the context. Nobody reads it, and it is not in the repo.

Existing controls assume a human wrote the code and a human reviewed it.
trustedoss.github.io/en/ai-coding/agent-governance
The map

What we built

Two areas, and the tools that run what they produce

trustedoss.github.io/en
The map CC BY 4.0

What Trusted OSS covers

An initiative of the OpenChain Korea Work Group, free to use and adapt.

PART 1 Build the program ISO/IEC 5230 and 18974 self-certification 9 agents → 24 artifacts → declaration PART 2 Govern AI coding A 5-level maturity model ad-hoc → rules → gates → AI defense → monitoring both built in the DevSecOps guide A different kind of risk. They meet on the roadmap, slide 18 PART 3 Run it TRUSCA when the whole program has to keep running BomLens when all you need is an accurate SBOM
trustedoss.github.io/en
Part 1

Build the program

Policies, processes, artifacts — from nothing to a declaration

trustedoss.github.io/en
Part 1 build the program 1 of 3

What the two standards actually ask for

ISO/IEC 5230 ONLY license compliance License obligations Notices Contribution policy SHARED BASE build it once, it counts for both Policy · Organization Process · Training SBOM ISO/IEC 18974 ONLY security assurance CVE tracking Response Records
The shared base is the larger half. Build one and most of the other is already done. The OpenChain Korea Work Group publishes an enterprise guide and policy and process templates for both.
trustedoss.github.io/en/docs/overview/checklist-mapping
Part 1 build the program 2 of 3

An agent writes each part of the program

Nine of them, 24 artifacts, run in order. Every one is a prompt you can read. We will open the policy agent live: steps, then output.

Organization
roles, RACI, appointment letter
steps  ·  output
Policy
OSS policy, allowed license list
steps  ·  output
Process
approval, pre-release check, vulnerability response
steps  ·  output
SBOM
generation scripts, license report
steps  ·  output
Vulnerability
CVE report, remediation plan
steps  ·  output
Training
curriculum, completion tracking
steps  ·  output
Conformance
gap analysis, declaration draft
steps  ·  output
trustedoss.github.io/en/docs/policy
Part 1 build the program 3 of 3

How you declare conformance

  1. Download the checklist OpenChain-Project/Reference-Material · 25 items each
  2. Self-assess — yes or no on every item your gap analysis already answers most of them
  3. Register openchainproject.org/get-started
No external audit. No cost. The declaration is valid for 18 months.
openchainproject.org/get-started
Part 2

Govern AI coding

Five kinds of control, and which ones you already have

trustedoss.github.io/en
Part 2 AI coding governance 1 of 10

Five layers, one slide each

What to add, a sample to copy, and where it runs today.

Level See it
L1 Prompt-dependent policy in one person's memory, or nowhere —
L2 Rules in the repo CLAUDE.md, AGENTS.md rules-template
L3 Blocked in CI/CD DevSecOps gitleaks, semgrep, grype cicd-quick
L4 AI defense layer 4a review · 4b fuzzing · 4c agent and MCP tools ai-security-review
L5 Continuous monitoring DevSecOps dependabot, DAST dependabot.yml
Levels 3, 4 and 5 all run in TRUSCA's own CI. The workflows sit in one repository you can fork: ai-coding-best-practice.
trustedoss.github.io/en/ai-coding/strategy
Part 2 AI coding governance 2 of 10
Level 1

Policy that lives in one person's head

"Use only MIT-licensed code" typed into the prompt, every time. There is no file to show you at this level. Nothing written down is nothing to review, inherit, or audit.
trustedoss.github.io/en/ai-coding/strategy
Part 2 AI coding governance 3 of 10
Level 2

Rules the agent reads before it writes

What you add
CLAUDE.md, AGENTS.md, .cursor/rules in the repository
Sample
A template to copy today, plus per-tool setup
In practice
trustedoss.github.io runs on one, and so does ai-coding-best-practice
The agent treats a rule as guidance, never as a gate. That gap is the whole reason level 3 exists.
trustedoss.github.io/en/ai-coding/rules-template
Part 2 AI coding governance 4 of 10
Level 3

The gate that does not negotiate

DevSecOps
What it stops
Tools
Runs in
Keys and tokens left in the source
gitleaks
secret-scan.yml
Flaws in the code you wrote
semgrep, CodeQL
sast.yml
SCA
CVEs and licenses in what you pulled in
syft · grype · cdxgen · Trivy
sca-self.yml
Secrets first. A leaked key cannot be un-leaked, and rotating it is not the same as never leaking it. Turn them on one at a time. cicd-quick walks the order. Container and IaC scanning join when you run either, and the reference repository has both.
trustedoss.github.io/en/ai-coding/cicd-quick
Part 2 AI coding governance 5 of 10
Level 4 · why it exists

Three places level 3 stops

What it flags

Mixed with false positives. A human re-judges each one.

What it misses

Business logic, permission checks, state transitions. No rule describes them.

What it never sees

Tool descriptions and tool output the agent reads. They never reach a diff.

What level 4 does about each
4a · findings-driven review

Raises precision on what was already flagged.

4b · AI fuzzing

Searches the area that was never flagged at all.

4c · agent and MCP tools

Guards what the agent calls, not what it writes.

trustedoss.github.io/en/ai-coding/strategy
Part 2 AI coding governance 6 of 10
Level 4a

What actually reaches the model

YOUR REPOSITORY semgrep.sarif, grype.json 8 findings, 5 lines each model true positive or false risk, exploit path → PR comment, not a gate
This runs on every pull request in TRUSCA — ai-review.yml. Advisory only, never a merge gate, and it skips entirely when no API key is set.
trustedoss.github.io/en/ai-coding/ai-security-review
Part 2 AI coding governance 7 of 10
Level 4b

Finding what no rule describes

READ Endpoint signature GENERATE Boundary, malformed RUN IT Against the app WATCH 5xx, malformed, bad state Business logic and edge-case input handling, the area no rule describes
Running
ai-fuzzing.yml in the best-practice repository, on push and weekly
This one runs the app. Everything before it only reads. Which is why it lands on a schedule rather than on every commit.
trustedoss.github.io/en/ai-coding/strategy
Part 2 AI coding governance 8 of 10
Level 4c

An MCP server is supply chain input too

Every server the agent calls is a dependency you did not review.

Agent npm · postmark-mcp Mail service Recipient hidden BCC Outside address
1.0.15 clean
1.0.16+ A hidden BCC copied every outgoing mail to an outside address
A review at adoption would have passed it. It was clean at the time.

The starting version is the researcher's estimate. Source: Snyk.

snyk.io · malicious MCP server on npm
Part 2 AI coding governance 9 of 10
Level 4c

Six controls, and how to review

1 to 5 are Microsoft Incident Response and the MCP spec turned into working rules. 6 is from the case on the previous slide.

Scan first
Snyk agent-scan, Cisco mcp-scanner — check what they transmit first
Then govern
ToolHive, agentgateway — a person still judges scope and egress
trustedoss.github.io/en/ai-coding/agent-governance
Part 2 AI coding governance 10 of 10
Level 5

What keeps running after the merge

LEVELS 1 TO 4 LEVEL 5 Write · rules · gate merge Deploy, then every day after it
Updates
Patches raised for you, five ecosystems
Dependabot
trusca dependabot.yml
Rescan
SBOM rebuilt and rescanned daily
cdxgen · Trivy
trusca sca-self.yml
DAST
The deployed app probed, not the source
OWASP ZAP
best-practice dast.yml
Dogfooding
The scanner scans itself, advisory
TRUSCA itself
trusca dogfood-scan.yml
A CVE published tomorrow lands in code you merged last year.
trustedoss.github.io/en/devsecops/monitoring
Part 3

Run it

Documents do not execute themselves. These tools do

trustedoss.github.io/en
Part 3 running it 1 of 6

Writing the artifacts is not running the program

  • A policy document does not block a forbidden license
  • A process document does not record an approval
  • One SBOM does not track the next CVE
18974 §4.3.2 asks for monitoring after release, a judgement on every finding, and a record of that judgement. Including the findings you decide need no action (§4.3.2.2)
ISO/IEC 18974 §4.3.2
Part 3 running it 2 of 6

TRUSCA — Apache-2.0, self-hosted SCA

The answer to the slide before. Stand it up as it is, no licence to buy.

cdxgen, more than 30 ecosystems
Trivy database — NVD, OSV, GHSA, EPSS, KEV
VEX import and export, 7 triage states
3-tier license policy, CI gate, generated NOTICE
RBAC, audit log, Compose and Helm
Runs inside your own network. Neither the code nor the SBOM leaves it.
github.com/trustedoss/trusca
Part 3 running it 3 of 6

Why this one

SELF-HOSTED Runs inside your own network Neither the code nor the SBOM leaves it. Apache-2.0 SIGNALS EPSS, KEV and VEX, not just CVSS Exploit probability and known exploitation, in the finding EVIDENCE Every judgement is recorded Seven triage states, RBAC, an audit log the auditor can read REGULATION It drafts the documentation G7 AI elements mapped to the EU AI Act and Korea's AI Act
No licence, no procurement, no data leaving the building.
Website trustedoss.github.io/trusca Live demo trusca-demo.duckdns.org Source
trustedoss.github.io/trusca
Part 3 running it 4 of 6

What actually arrives as an SBOM

Missing dependencies are only part of it.

BomLensBomLens is what SK Telecom hands suppliers along with its guidance. Open source, so anyone else can use it too. 10 languages · Apache-2.0 · runs locally
github.com/sktelecom/bomlens
Part 3 running it 5 of 6

One run, three documents

This is what you hand the supplier. No account, no upload — it runs on their machine.

WHAT YOU POINT IT AT Source · container image Binary · firmware An SBOM · an AI model BomLens WHAT COMES OUT SBOM Open source notice Security risk report
Suppliers who cannot hand over source can still hand over an SBOM.
Website sktelecom.github.io/bomlens Live demo /demo Source
sktelecom.github.io/bomlens/guides/by-input
Part 3 running it 6 of 6

Where the three are headed

One defines the programme, one runs it, one feeds it from outside.

Trusted OSS defines what the programme must do trustedoss.github.io/en INSIDE THE COMPANY TRUSCA policy applied, findings tracked, evidence kept — every day trustedoss.github.io/trusca SBOM SUPPLIER SIDE BomLens the supplier generates it sktelecom.github.io/bomlens Next: the agent asks before it pulls
All three are free and open. Two have a live demo you can open right now.
TRUSCA demo trusca-demo.duckdns.org BomLens demo /bomlens/demo
github.com/trustedoss/trusca

Questions

Trusted OSStrustedoss.github.io/en BomLensgithub.com/sktelecom/bomlens TRUSCAgithub.com/trustedoss/trusca
Haksung Jang Open Source Program Manager, SK Telecom
Ambassador, OpenChain Project
Lead, OpenChain Korea Work Group
Thank you
trustedoss.github.io/en · CC BY 4.0
Presenter notes ·
00:00
← → move
F fullscreen
S notes
T timer
D dark
P print
H help