Lately I've been trying to lock down our software supply chain security and it turned into a bigger project than expected. Sharing the checklist we landed on in case it helps someone else.
1. Know what you ship — SBOM generation
Start with sbom generation for every build. If you can't list your dependencies, you can't secure them.
2. Secure software dependencies
Add dependency vulnerability scanning to CI so a risky package fails the build early. The goal is to secure software dependencies before they reach production, not after.
3. Open source license compliance
This is the part everyone forgets. You need open source license compliance checks to detect open source licensing issues before legal does.
4. Automate it
Manual reviews don't scale. We're looking for an automated tool that handles scanning + SBOM + licensing without needing source code access.
What are you all using for this? Would love recommendations.
Top comments (0)