Sourced / Security blog
Dependency security
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
30 articles / Page 1 of 2
- Dependency security
Assess Maintainer Security Signals
Review package stewardship, release controls, and response history without treating popularity or one score as a safety guarantee.
- Dependency security
Assess vulnerable code paths without overstating certainty
Trace an affected dependency from application entry points to the vulnerable behavior. Record supporting evidence, counterevidence, dynamic paths, and unknowns.
- Dependency security
Check whether an SBOM covers the released software
Compare an SBOM with packaged components and a defined acceptance profile. Track missing identities, versions, suppliers, relationships, and coverage gaps.
- Dependency security
Document a security backport when an upgrade is blocked
Evaluate a backport against a normal corrective upgrade. Record the blocker, patch identity, maintenance owner, regression evidence, and exit plan.
- Dependency security
Detect manifest and lockfile drift before release
Verify that a clean install respects the reviewed dependency graph. Record package-manager settings, workspace scope, install scripts, and unexpected lockfile changes.
- Dependency security
Expire Dependency Risk Exceptions
Set a time limit and recheck trigger for dependency waivers so temporary risk decisions do not become permanent defaults.
- Dependency security
Generate an SBOM for the artifact you release
Build a release inventory from packaged software. Record the artifact digest, generator context, dependency relationships, and known collection gaps.
- Dependency security
Reassess advisories when records change or are withdrawn
Preserve advisory history while revising local triage. Distinguish withdrawal, range correction, replacement records, and a verified deployed fix.
- Dependency security
Interpret OpenSSF Scorecard Results
Read individual OpenSSF Scorecard checks in context and turn weak results into targeted supply-chain review tasks.
- Dependency security
Inventory dependencies in the release you actually ship
Connect declared packages, resolved dependency paths, and shipped components. Record direct owners, transitive paths, build-only use, and inventory gaps.
- Dependency security
Inventory Exposed Software Components
Map software versions to internet-facing services and owners so dependency alerts reach the systems that can be affected.
- Dependency security
Match a Release Artifact to Its Source
Tie a deployed release file to the reviewed source commit by checking the artifact digest, provenance, and release record.
- Dependency security
Merge advisory aliases without merging different issues
Reconcile CVE, GHSA, and other advisory identifiers through explicit alias evidence. Preserve affected packages, source revisions, and separate upstream relationships.
- Dependency security
Minimize GitHub Actions Token Permissions
Give each GitHub Actions job only the token permissions it needs, with reviewed write exceptions and negative tests.
- Dependency security
Pin GitHub Actions by Commit
Replace mutable GitHub Action tags with reviewed commit IDs and keep an owner and update path for each pinned action.
- Dependency security
Plan a package upgrade around the affected behavior
Choose a corrective version with evidence. Trace every dependency path, select targeted regressions, and verify the built and deployed artifact after the update.
- Dependency security
Prioritize a KEV match with local deployment evidence
Connect a CISA known-exploitation record to the exact advisory and deployed component. Record exposure, uncertainty, mitigation, and accountable remediation.
- Dependency security
Publish a Security Reporting Policy
Give researchers a clear private contact route, scope, response expectations, and a machine-readable security.txt file.
- Dependency security
Record a VEX decision for an exact product release
Connect a vulnerability applicability decision to a specific product, evidence, reviewer, and recheck trigger. Keep uncertainty visible in VEX records.
- Dependency security
Keep release artifacts and SBOM revisions aligned
Decide when to regenerate an SBOM and when to update vulnerability analysis instead. Preserve artifact mappings, previous inventories, and correction history.
- Dependency security
Replace End-of-Life Runtimes
Plan an owned runtime upgrade by finding deployed versions, blocked packages, compatibility risks, and rollback evidence.
- Dependency security
Review a dependency update before merging it
Check the advisory, resolved dependency graph, package source, behavior changes, and actual test results before approving an automated dependency update.
- Dependency security
Review Package Registry Trust
Check a new package's namespace, publisher rights, release history, and exact artifact before adding it to a build.
- Dependency security
Publish to npm, PyPI, and crates.io with OIDC
Set up trusted package publishing for TypeScript, Python, and Rust. Check package contents, restrict release authority, and verify the published result.