How to provide security fixes in a high constraint ecosystem? Practical examples with the Jenkins project

Lessons learned from a security team member of a widely used open source project (Jenkins). How to solve security issues when you need to face multiple constraints like living in public/private plugins ecosystem, assuring backward binary compatibility, providing escape-hatch or even better progressive migration. I will present our approach to tackle those obstacles with practical examples.