domains / families / security / ossfuzz

ossfuzz

separate

Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-source project, reproducing an OSS-Fuzz bug report, or testing an OSS-Fuzz build before submitting it.

When to use

• setting up continuous fuzzing for an open-source project
• reproducing an OSS-Fuzz bug report
• testing an OSS-Fuzz build before submitting it
• distributed fuzzing infrastructure without managing servers
• coverage reports and bug tracking integrated with fuzzing
• testing existing OSS-Fuzz harnesses locally
• reproducing crashes from OSS-Fuzz bug reports

When not to use

• closed-source projects unless hosting own instance
• projects not meeting criticality score threshold
• proprietary or specialized fuzzing infrastructure
• fuzzing simple scripts that don't warrant infrastructure

Skill page

Source