umbrella issues covering multiple cases of similar issues across different components in the same Dapr building blocks. None of the issues were of critical or high severity. We found a vulnerability in a 3rd-party Adam@adalogics.com David Korczynski Security Researcher, Ada Logics David@adalogics.com The Dapr community members involved in audit were: Name Title Email Yaron Schneider Maintainer and steering committee security audit 2023 Threat model Dapr is a framework for building cloud-native applications. It consists of a runtime and a set of building blocks that allow users to move infrastructure-related tasks

Distributed Application Service (EDAS) OAM-based PaaS implementation Empower app developers to focus on building and delivering apps without concerning operations Provide manageability of CRDs, consistency infrastructure platforms with limited code portability across clouds and edge Microservice building blocks Cloud + Edge Sidecar architecture Sidecar architecture Standard APIs accessed over services State management Create long running, stateless and stateful services Microservice building blocks Service-to- service invocation Perform direct, secure, service- to-service method

Mark Russinovich @markrussinovich Open Application Model dapr: Distributed Application Platform Building Cloud Scale, Hybrid Applications Agenda Application Models Describes the topology of your application services and data stores Programming Models dapr: Distributed Application Runtime Building blocks for building scalable distributed apps Open Application Model (OAM) Platform agnostic application equivalents that can run anywhere Introducing Dapr A portable, event-driven, serverless runtime for building distributed applications across cloud and edge Runs on multiple environments for cloud, on- prem

in this space and will further increase investment to improve security across its projects and community. The focus for future work is integrating fuzzing into more projects, enabling sustainable fuzzer

1https://github.com/dapr/dapr/pull/1989 2https://v1-rc3.docs.dapr.io/developing-applications/building-blocks/secrets/secrets-scopes/ 3https://v1-rc3.docs.dapr.io/operations/configuration/secret-scope/