Supply Chain Security
Software Composition Analysis (SCA) is now table stakes for secure development. But the tooling landscape is fragmented: there are commercial platforms, open source scanners, and everything in between. Choosing the wrong tool means either missing real vulnerabilities or drowning in false positives. This guide compares the four most widely-deployed
Supply Chain Security
Generating an SBOM (Software Bill of Materials) is the easy part. The hard part is doing something useful with it — automatically enforcing policies that prevent vulnerable, unlicensed, or untrusted components from making it into your production builds. This guide covers the full SBOM lifecycle: generation, validation, policy enforcement, and continuous
Supply Chain Security
Automated dependency updates are your first line of defense against supply chain vulnerabilities.
Supply Chain Security
In February 2021, security researcher Alex Birsan compromised 35 major companies — including Apple, Microsoft, PayPal, and Tesla — using a technique called dependency confusion. He uploaded malicious packages to public registries with the same names as internal private packages, then watched as the build systems of major corporations automatically downloaded and
Security Testing
Software supply chain attacks have become one of the most effective attack vectors in modern software.
Security Testing
Container image signing closes a critical gap in software supply chain security: verifying that the image running in production is exactly the image your CI pipeline built — and nothing else. Sigstore and its Cosign tool make this practical, with keyless signing that eliminates the burden of managing long-lived private
Security Testing
A Software Bill of Materials (SBOM) is the foundation of modern supply chain security.
Security Testing
Dependency vulnerability scanning is table stakes for modern CI pipelines.
Security Testing
in-toto is the foundational framework for software supply chain security that powers much of modern tooling — including SLSA provenance and Sigstore attestations. Understanding in-toto means understanding the underlying model that these higher-level tools implement. The Problem in-toto Solves The SolarWinds attack succeeded because attackers compromised the
Security Testing
Two SBOM formats dominate the software supply chain landscape: CycloneDX and SPDX.
Security Testing
SLSA (Supply-chain Levels for Software Artifacts, pronounced "salsa") is a security framework from Google that provides a common vocabulary and checklist for supply chain integrity. Rather than describing a single policy, SLSA defines four progressively stricter levels — allowing organizations to incrementally improve their supply chain security posture.