Loading content
Conceptual practices to secure software dependencies and the supply chain using governance, scanning and integrity mechanisms.
Dependency Security covers practices, processes, and tools to protect project dependencies and the software supply chain from compromised packages, malicious code, and unpatched vulnerabilities. It includes governance, automated scanning, signatures and supply-chain standards to ensure integrity, trustworthiness and timely incident response.
Average time between disclosure and detection within the system.
Percentage of artifacts with verifiable signatures.
Count and severity classification of vulnerabilities per release.
A SaaS provider blocks builds with critical Dependabot findings and opens automated remediation tickets.
A framework project publishes an SBOM for every release to provide consumers with transparency.
The platform validates artifact signatures during deployment to ensure integrity.
Inventory: record dependencies, registries and processes
Increase visibility: introduce SBOM generation and dependency graphs
Automate: integrate scans, signing and policy gates into CI