Download PDF

Use these for SCA, dependency discovery, known vulnerability checks, and supply-chain weirdness.

• socket.dev – https://socket.dev 
• osv-scanner – GitHub – google/osv-scanner: Vulnerability scanner written in Go which uses the data provided by htt…
• OWASP dependency Check – OWASP Dependency-Check | OWASP Foundation

Use these for SBOM generation, SBOM tracking, vulnerability monitoring, and post-approval ownership.

• OWASP Dependency-Track – Dependency-Track | Software Bill of Materials (SBOM) Analysis
• Syft – GitHub – anchore/syft: CLI tool and library for generating a Software Bill of Materials from contain…
• Trivy – GitHub – aquasecurity/trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, K…

• SigStore – https://www.sigstore.dev/
• OpenSource Scorecard – https://scorecard.dev/

Open Source Security Podcast – https://opensourcesecurity.io/category/podcast/