Showing 1–4 of 4 articles
Passwords that are still in Git history
Deleting a secret from the latest version does not invalidate it or remove every earlier copy. Contain the credential first, then assess repository history and any evidence of use.
Read the visual guide
What to do with a software bill of materials
A software bill of materials lists components in a product or release. Its value comes from matching that inventory to deployed systems, relevant advisories, owners, and update decisions.
Read the visual guide
An open-source licence is not a security review
Being able to inspect source code is valuable, but it does not prove that a component has been reviewed or is safe for your use. Assess the actual dependency and its operating context.
Read the visual guide
Plugin and package risk: check the dependency you actually deploy
A useful dependency brings another project’s code into your environment. Review its source, maintenance, permissions, version, and update path before making it part of a critical service.
Read the visual guide