The Apache Software Foundation (ASF) reported running security scans across 230 repositories during a three-day window in August 2026. Its case study shows that foundation-scale scanning depends on more than a scanner: ASF combined an automated audit pipeline, project-specific context and threat models, a separate Project Glasswing scanning effort, and its established security disclosure process. Findings were still being shared with projects and remediation was underway when ASF published its account on September 3, 2026.
What ASF did—and what the 230-repository figure means
ASF Tooling and ASF Security described the effort in Security Scanning at Foundation Scale, published September 3, 2026. The work took place in August and covered 230 repositories over a three-day window. That is a reported scan effort, not a claim that all ASF repositories were scanned, that the same throughput is routine, or that remediation was complete.
Preparation involved a distinct group of projects: 75 Project Management Committees (PMCs), representing more than 180 repositories, signed up to develop threat models. ASF Security reviewed those models before they were used. The more-than-180 count belongs to the threat-model signups; it is not an alternate count of the 230 repositories scanned.
The case study arose within ASF’s Responsible AI Initiative and describes two related but separate systems: ASF Tooling’s automated audit pipeline and the Project Glasswing harness. ASF compared its pipeline with Glasswing on the same repositories to learn how each performed and tune scans. The pipeline was not itself the Glasswing harness.
#1 Best Overall
How the ASF audit pipeline was designed
Three model tiers for different jobs
ASF Tooling said it had operated an automated audit pipeline since early 2026. Running on Gofannon, an agent platform developed by the Tooling team, it evaluates code against the OWASP Application Security Verification Standard (ASVS). The pipeline was first used for Apache Trusted Releases, a release-management platform, and was expanded toward a managed scanning service for ASF projects.
Its work is divided among three configurable tiers:
- Light: high-volume filtering.
- Medium: building inventories of code contents.
- Heavy: analysis that requires more reasoning.
The case study lists an Opus/Sonnet/Haiku ensemble and a Mythos/Gemma/Qwen ensemble. In the latter, the two lighter tiers use self-hosted models. ASF says model combinations can be swapped without changing the pipeline, allowing the team to balance quality, speed, and cost; the account does not provide a comparative benchmark for those combinations.
Project-defined scope and audit guidance
Projects could specify what they wanted scanned and run the process through a browser or API without supervision. They could also supply audit guidance about their security posture, architecture, coding standards, and deployment choices. ASF Tooling said this context reduced false positives and incorrect inferences reaching final reports. The case study does not quantify that reduction independently.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy threat models mattered
ASF Security invited interested projects to document security-relevant components, trust boundaries, assumptions, and areas outside the scan’s scope. A useful model clarifies what the project considers trusted by design, what remains the operator’s responsibility, and which decisions should not need to be repeatedly re-evaluated by a scanner.
A Threat Model skill contributed by Alpha-Omega helped create initial models and support communication with PMCs. ASF Security reviewed each model for correctness and applicability to the code before using it downstream. This review matters: project context can focus automated analysis, but only if the assumptions actually fit the software being scanned.
Rank #3
ASF estimated that scanning against a reviewed threat model cost roughly one-fifth less than scanning without one. That is the ASF team’s estimate from this effort, not an independently validated benchmark or a general promise of savings. ASF attributed the difference to focusing analysis on consequential areas and avoiding repeated rediscovery of documented decisions.
What Project Glasswing added
ASF also joined Anthropic’s Project Glasswing for security research. The case study says Glasswing ran parallel Claude Code sessions against Mythos 5, using simple initiating prompts and no customization of the harness. ASF compared this work with its own pipeline on the same repositories as part of learning how to tune scans.
The authors reported that Glasswing findings included critical vulnerabilities with drafted patches, which were reviewed separately. They did not publish an aggregate count of confirmed findings, fixes, or CVEs. The presence of a drafted patch should therefore not be read as proof that a finding was validated, deployed, or fully remediated.
How findings moved from scan to project
Scan findings followed ASF’s official disclosure path through Security governance to the responsible project. Sensitive reports went first to the affected project’s security or private list. The project’s PMC assessed impact and decided significance and remediation timing, as it would for another security report.
Reports took deployment context into account; prioritization did not rely on severity labels alone. This keeps a scan result in the hands of maintainers who can judge how the software is configured and used. The case study describes remediation as underway at publication, rather than reporting a completed disposition for all findings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How this fits alongside other foundation security work
Foundation security programs can cover quite different activities, so a scan count alone does not make programs comparable. The Linux Foundation’s security resources describe LFX automated scans and fix recommendations for project stakeholders, CNCF support for third-party security audits and encouragement of fuzzing for projects with high code complexity, and ongoing security scanning for FINOS projects. These are separate examples, not components of ASF’s program or independent evaluations of it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
OpenSSF Scorecard is another complementary tool: it assesses repository security practices such as maintenance, dependency pinning, and code review before merge, rather than serving as the same kind of source-code vulnerability audit described in the ASF case study. OpenSSF’s August 28, 2023 announcement of Scorecard v4.12 documented GitLab support and continuous monitoring through GitLab CI/CD. That is a version- and date-specific announcement, not confirmation of current compatibility.
For any foundation-scale program, useful comparison questions include who owns coverage, whether scanning is managed or self-service, what analysis is performed, what project context is available, how findings are triaged, and how often scans recur. ASF’s account gives detail on context and disclosure, but it does not publish a final validation rate, total fix count, recurring scan cadence, or full cost accounting.
What ASF said it planned next
The case study described incremental scans, additional scan types, and project self-service funded through a Foundation-managed token budget as planned enhancements. These were plans, not reported capabilities already in place. The article does not state final counts for confirmed vulnerabilities, completed fixes, or CVEs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
