A practical checklist for software supply chain security

devops team — Fri, 17 Jul 2026 06:46:19 +0000

Lately I've been trying to lock down our software supply chain security and it turned into a bigger project than expected. Sharing the checklist we landed on in case it helps someone else.

1. Know what you ship — SBOM generation

Start with sbom generation for every build. If you can't list your dependencies, you can't secure them.

2. Secure software dependencies

Add dependency vulnerability scanning to CI so a risky package fails the build early. The goal is to secure software dependencies before they reach production, not after.

3. Open source license compliance

This is the part everyone forgets. You need open source license compliance checks to detect open source licensing issues before legal does.

4. Automate it

Manual reviews don't scale. We're looking for an automated tool that handles scanning + SBOM + licensing without needing source code access.

What are you all using for this? Would love recommendations.

npm Vulnerabilities Are Growing devnack

devops team — Thu, 16 Jul 2026 06:00:56 +0000

🧩 The Real Problem Isn’t Dependencies — It’s Visibility

Most developers rely on:

npm outdated
npm audit

But let’s be honest—these tools are:

❌ Noisy
❌ Hard to prioritize
❌ Not decision-friendly

They tell you everything, but help you decide nothing.

You don’t need a list.
You need clarity.
🧠 What This System Does