Sourced / Security blog
Dependency security
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
30 articles / Page 2 of 2
- Dependency security
Triage False-Positive Dependency Alerts
Check ecosystem, resolved version, artifact, and affected code path before closing a dependency alert as non-applicable.
- Dependency security
Unblock Transitive Dependency Fixes
Trace a vulnerable transitive package to its parent dependency, then choose a tested override, upstream update, or replacement.
- Dependency security
Use dated EPSS scores with local exposure evidence
Keep exploitation forecasts separate from asset risk. Record EPSS date, probability, percentile, local applicability, and the remediation decision.
- Dependency security
Match advisory ranges to exact installed versions
Compare package ecosystem, resolved versions, advisory intervals, and vendor patches. Keep version matches separate from reachability and local impact.
- Dependency security
Verify Build Provenance Claims
Check a provenance statement against the artifact digest, trusted builder identity, source revision, and expected build path.
- Dependency security
Verify Package Provenance
Check whether a package release has verifiable evidence that binds its published bytes to a source revision and build process.