{"id":77778,"date":"2020-09-29T15:00:02","date_gmt":"2020-09-29T12:00:02","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/"},"modified":"2020-09-29T15:00:02","modified_gmt":"2020-09-29T12:00:02","slug":"how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/","title":{"rendered":"#How to Safely Use Open Source Code in Your Project \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af71029cdb11\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af71029cdb11\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Coding_Before_Open_Source\" >Coding Before Open Source<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#The_Rise_of_Open_Source\" >The Rise of Open Source<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#The_Security_Issues\" >The Security Issues<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Why_Open_Source_Is_Attractive_to_Hackers\" >Why Open Source Is Attractive to Hackers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#What_You_Can_Do_to_Reduce_the_Risk\" >What You Can Do to Reduce the Risk<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Create_an_Open_Source_Register\" >Create an Open Source Register<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Run_Automatic_Audits\" >Run Automatic Audits<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Create_a_Vulnerability_Map\" >Create a Vulnerability Map<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Update_Your_Register_and_Vulnerability_Map\" >Update Your Register and Vulnerability Map<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Check_the_Open_Source_Licenses_and_Adhere_to_Them\" >Check the Open Source Licenses and Adhere to Them<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#Update_Your_Open-Source_Components\" >Update Your Open-Source Components<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-safely-use-open-source-code-in-your-project-cloudsavvy-it\/#The_Cost_of_Open_Source\" >The Cost of Open Source<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#How to Safely Use Open Source Code in Your Project \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<figure id=\"attachment_7083\" style=\"width: 700px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"imgchk9 wp-image-7083 size-full\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/162d5e06bad703bf402da091bba0930a\/p\/uploads\/2020\/09\/f40c3586.png\" alt=\"Two men and one woman developing programming code.\" width=\"700\" height=\"300\" data-crediturl=\"https:\/\/www.shutterstock.com\/image-photo\/developing-programming-coding-technologies-website-design-703607833\" data-credittext=\"Shutterstock\/REDPIXEL.PL\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"imagecredit\"><a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/www.shutterstock.com\/image-photo\/developing-programming-coding-technologies-website-design-703607833\">Shutterstock\/REDPIXEL.PL<\/a><\/span><\/figcaption><\/figure>\n<p>There\u2019s open-source code inside almost every software development project you can think of. Developers love it. But you need to understand the hidden risks and how to minimize them, or you could leave your <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>lication open to unknown security vulnerabilities.<\/p>\n<h2 id=\"coding-before-open-source\"><span class=\"ez-toc-section\" id=\"Coding_Before_Open_Source\"><\/span>Coding Before Open Source<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once upon a time software developers wrote everything from scratch. Then code libraries, toolkits, and other add-ons started to appear. You could get a leg up by using a toolkit to provide some functionality, such as a reporting module or an interface widget. You could pop these into your project as ready-made fully formed components and use them straight away. The alternative was to waste time, money, and development effort reinventing the wheel.<\/p>\n<p>Of course, over time you\u2019d build up your own library of routines and modules that had been written in-house. So when you were developing a new code routine or interface element, you had three options. Write it yourself, reuse some previously written in-house code, or buy in a library or toolkit.<\/p>\n<h2 id=\"the-rise-and-rise-of-open-source\"><span class=\"ez-toc-section\" id=\"The_Rise_of_Open_Source\"><\/span>The Rise of Open Source<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The advent of open-source code changed all of that. Open-source software makes the source code to a project freely available for use by others, within the limits of a\u2014usually benign\u2014license. The growth and uptake of open source have both been staggering. The word <em>proliferation<\/em> doesn\u2019t seem to cover it. There has been a phenomenal increase in open-source software, and not just in terms of the mind-boggling number of open-source projects and products that exist, but also in the use of open source within commercial products.<\/p>\n<p>Open-source software hit critical mass a few years ago, and it has rocketed from a niche position on the sidelines to a fully embraced mainstream development resource. Because it was driven and developed by a community and not a traditional commercial enterprise, it was regarded as well, sort of amateur.<\/p>\n<p>Now it feels like open source has grown up and matured. And it has. But the biggest change has been a wider appreciation of open source, an understanding of the benefits it brings, and recognition that including open source in your product isn\u2019t anything of which to be ashamed.<\/p>\n<p>Estimates suggest non-trivial software projects are writing about 20 percent of original code at most. The other 80 percent is open source. The major open-source repository hosting site,\u00a0<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/github.com\/\">GitHub<\/a>, hit over 100 million repositories in 2018.\u00a0And there are many other hosted Git platforms, such as\u00a0<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/about.gitlab.com\/\">GitLab<\/a>\u00a0and\u00a0<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/bitbucket.org\/product\">BitBucket<\/a>.<\/p>\n<p>Open source is a software development phenomenon. But it\u2019s not all roses in the development garden. There are issues that you need to be aware of, and manage.<\/p>\n<h2 id=\"the-security-issues\"><span class=\"ez-toc-section\" id=\"The_Security_Issues\"><\/span>The Security Issues<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-5207\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/e0b71e050ff364d952ee332352a90477\/p\/uploads\/2020\/06\/425cc0e9.png\" alt=\"bugs over time\" width=\"700\" height=\"376\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>Using open-source components in large software projects reduces development costs, shortens the end-to-end development time, and\u2014it has been argued\u2014promotes innovation. Because it frees your development staff from the mundane, it allows them to focus on the unique and market-attractive aspects of your product.<\/p>\n<p>There are some open-source products that have a commercial entity behind them. The organization releases their product under a dual-licensing scheme. A commercial version will have an official, professional, support channel, and may contain other benefits like proprietary extras that are bundled with the product. They also release a community-supported version that will benefit from the coding efforts of the commercial team as well as from the contributions from its own community. Significant community contributions will also make their way back into the commercial version.<\/p>\n<p>However, the majority of open -source projects are completely community-driven. They may have the backing of commercial entities, but that backing is donations and sponsorship, not code contributions.<\/p>\n<p>Regardless of their provenance, the open-source components that are chosen to be included in new development projects tend to be well-established and reputable projects in their own right. They have earned a high degree of trust. But that isn\u2019t always the case. Sometimes the functionality you need is available, but it is contained in a new and somewhat unproven project.\u00a0But you\u2019ve got the source code, right? You can do a code review of it.<\/p>\n<p>From a security viewpoint, open source is neither more, nor less secure than proprietary home-grown code. It\u2019s all human-written code after all. Advocates of open source point to\u00a0<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Eric_S._Raymondout\">Eric S. Raymond\u2019s<\/a>\u00a0law that he named in honor of\u00a0<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Linus_Torvalds\">Linus Torvalds,<\/a>\u00a0which states that \u201c<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Linus%27s_law\">given enough eyeballs, all bugs are shallow<\/a>.\u201d With enough people reviewing the code and beta-testing it, issues should be identified, characterized, and fixed quickly.<\/p>\n<p>That\u2019s true as far as it goes. But security issues are not necessarily bugs. A vulnerability can be a circumstance that arises as a side effect of complex logic in a project of many source code modules amounting to millions of lines of code. The product does what it is supposed to, and so it is seen to be working as intended. And so it passes code review, product verification, field testing, and gets a clean bill of health.<\/p>\n<p>Outside of blind luck and happenstance, that review, test, trial, and release loop won\u2019t unearth security vulnerabilities.<\/p>\n<h2 id=\"why-open-source-is-attractive-to-hackers\"><span class=\"ez-toc-section\" id=\"Why_Open_Source_Is_Attractive_to_Hackers\"><\/span>Why Open Source Is Attractive to Hackers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Moreover, there are aspects of open source that are positively attractive to hackers and threat actors. They can see the source code, too. They can look for vulnerabilities with a different mind-set than the average community contributor who, although they may well be a competent developer, is unlikely to have any real security background.<\/p>\n<p>Of course, contributors to open source come in all flavors with varied backgrounds. Some of them will undoubtedly have real-world security experience\u2014but they\u2019re going to be the minority. Threat actors are another beast altogether. And they\u2019re not limited to finding vulnerabilities, they can inject them, too.<\/p>\n<p>There have been many cases where a threat actor introduced a vulnerability via a patch they created and submitted to a project. It made its way through code review, into the code-base, and into the next release of the product.<\/p>\n<p>Perhaps the ultimate example of this was a JavaScript component called event-stream. This open-source project was maintained by a single developer. The burden of stewardship of the project outgrew him. He was persuaded to hand it over to a new maintainer.<\/p>\n<p>The new maintainer was a threat actor. They took over the project, ran it as normal for a short period, then added malicious code to it. Every copy of every other program that used that software component was quietly hijacking certain types of Bitcoin wallet for the threat actor.<\/p>\n<h2 id=\"what-you-can-do-to-reduce-the-risk\"><span class=\"ez-toc-section\" id=\"What_You_Can_Do_to_Reduce_the_Risk\"><\/span>What You Can Do to Reduce the Risk<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"imgchk9 alignnone wp-image-6821 size-full\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/36f883fe2570b7b73040a9547e923569\/p\/uploads\/2019\/07\/5999c4af.png\" alt=\"Unlocked and locked security\" width=\"700\" height=\"300\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>As with many aspects of security, you manage this risk by applying controls. That requires governance\u2014in other words, policies and procedures. Thankfully, there is software that can help.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Create_an_Open_Source_Register\"><\/span>Create an Open Source Register<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>You need to quantify the open source you are using. Create a register that lists the open-source components you use in your projects.\u00a0 List each open-source component, the version or versions you\u2019ve used, the projects you\u2019ve used them in, what the latest version is, and where it can be downloaded. In the design documentation for each of your projects, you should list the open-source components that are in use.<\/p>\n<p>The devil is in the details. Don\u2019t forget the dependencies and hierarchical nature of much of open source. Open-source projects often use other projects within themselves, nested like Russian dolls, or they require other open-source components to be installed on the target machine so that they can make use of them.<\/p>\n<p>Drill down into these dependencies, and list them in your open-source register.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Run_Automatic_Audits\"><\/span>Run Automatic Audits<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Vulnerabilities in open-source packages are a major issue for NPM, the package manager for JavaScript. To address this, they created an automatic audit tool that will scan for out-of-date packages with security updates.<\/p>\n<p>This, of course, has its limitations, and it\u2019s important to be conscious and not rely entirely on automatic tooling. It will only catch packages with known vulnerabilities and\u00a0<em>updates<\/em>. If the package has a vulnerability, but hasn\u2019t been updated to fix it, NPM audit will tell you nothing.<\/p>\n<p><strong>RELATED:<\/strong> <strong><em>Audit Your NPM Dependencies, They Account for 86% of Security Bugs<\/em><\/strong><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Create_a_Vulnerability_Map\"><\/span>Create a Vulnerability Map<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Your open-source register gives you a clear picture of the open source that you use.\u00a0The next step is to map known vulnerabilities onto that register. Sometimes, these can be discovered by visiting the project\u2019s home page and looking at the known issues list.<\/p>\n<p>The <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/nvd.nist.gov\/\">National Vulnerability Database<\/a> (NVD) will give you a much more granular picture. You can use their <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/nvd.nist.gov\/products\/cpe\/search\">search page to look up products<\/a> by name to find out which <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Common_Vulnerabilities_and_Exposures\">Common Vulnerabilities and Exposures<\/a> affect that software component. The NVD is a great resource, even if its format does take a bit of unraveling until you get used to it.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Update_Your_Register_and_Vulnerability_Map\"><\/span>Update Your Register and Vulnerability Map<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Of course, this is something you need to keep on top of. New vulnerabilities are discovered all the time, so the security state of your product at launch is likely to slowly erode over time.<\/p>\n<p>Recognizing this new need, there are commercial (<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/www.blackducksoftware.com\/\">Black Duck<\/a>, <a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/www.whitesourcesoftware.com\/\">WhiteSource<\/a>) applications that will help with this. They can scan your projects and identify open-source code, and look-up vulnerabilities automatically.\u00a0 Some of these (<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/fossa.com\/\">FOSSA<\/a>) offer a free tier.<\/p>\n<p>Static analysis of your codebase\u2014including the open-source components\u2014should be a standard part of your development rigor, anyway. Tools like\u00a0<a rel=\"nofollow noopener noreferrer\" target=\"_blank\" href=\"https:\/\/scan.coverity.com\/\">Coverity Scan<\/a>\u00a0can find defects in your code like buffer overflows that can lead to vulnerabilities. It will even advise on how they can be rectified.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Check_the_Open_Source_Licenses_and_Adhere_to_Them\"><\/span>Check the Open Source Licenses and Adhere to Them<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Ensure you understand the licenses that are in force on the open source that you use. There are many different licenses, so check that you are complying with all of the requirements. Involve your licensing or compliance officer, if you have one.<\/p>\n<p>Not complying with an open-source license can lead to litigation. Open-source projects are as quick to respond to breaches of licensing as commercial software houses.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Update_Your_Open-Source_Components\"><\/span>Update Your Open-Source Components<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>As vulnerabilities are fixed by the communities of the open source you use, make sure you upgrade your versions so that you benefit from those fixes. Open source uses a \u201cpull\u201d model. They announce a new fix and then you have to go and download that new version.\u00a0 This is the opposite of much commercial software that has a \u201cpush\u201d model where updates are transmitted to the registered users.<\/p>\n<p>Monitor the project pages for new version announcements, and download and test the new builds.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_Cost_of_Open_Source\"><\/span>The Cost of Open Source<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Open-source software is free to obtain, but it comes with a management and governance overhead. The implications have to be understood and controlled in order to use it safely and with minimum risk.\n<\/p><\/div>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener noreferrer\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/6982\/how-to-safely-use-open-source-code-in-your-project\/\" target=\"_blank\" rel=\"noopener noreferrer\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#How to Safely Use Open Source Code in Your Project \u2013 CloudSavvy IT&#8221; Shutterstock\/REDPIXEL.PL There\u2019s open-source code inside almost every software development project you can think of. Developers love it. But you need to understand the hidden risks and how to minimize them, or you could leave your application open to unknown security vulnerabilities. Coding&#8230;<\/p>\n","protected":false},"author":1,"featured_media":77779,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2020\/09\/f40c3586.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-77778","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/77778","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=77778"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/77778\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/77779"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=77778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=77778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=77778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}