Showing 1–3 of 3 articles
What to do with a software bill of materials
A software bill of materials lists components in a product or release. Its value comes from matching that inventory to deployed systems, relevant advisories, owners, and update decisions.
Read the visual guide
An open-source licence is not a security review
Being able to inspect source code is valuable, but it does not prove that a component has been reviewed or is safe for your use. Assess the actual dependency and its operating context.
Read the visual guide
Plugin and package risk: check the dependency you actually deploy
A useful dependency brings another project’s code into your environment. Review its source, maintenance, permissions, version, and update path before making it part of a critical service.
Read the visual guide