Blog | Endor Labs

What are Maven dependency scopes and their related security risks?

This article explores Maven dependency scopes: what are they, what are they used for, and how do they impact security risks?

The Government's Role in Maintaining Open-Source Security

Open-source software has become ubiquitous, powering many of the most critical infrastructure systems in the world, but its community-driven model presents a unique security risk. Because open-source projects are maintained by volunteers, they are often neglected and fall behind on security updates, which can have devastating consequences when critical infrastructure systems rely on vulnerable open-source components.

Introduction to Program Analysis

Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs.

More Than 30 Industry-Leading CISOs Personally Invest in Endor Labs

After a comprehensive diligence process on startups in the supply chain and open source security space, over 30 CISOs have chosen to personally back Endor Labs.

From cloud security to code security: why we've raised $25M to take on OSS dependency sprawl

From cloud security to code security - The story of Endor Labs.

Endor Labs Launches with $25M Seed Financing to Tackle Massive Sprawl of Open Source Software (OSS)

Solution from category-defining entrepreneurs and world-renowned experts helps developers spend less time dealing with security issues, more time accelerating their development through safe code reuse.

SBOMs are just a means to an end

Software has eaten the world. Modern society is dependent on software for everything from communicating with family to the medical devices keeping our loved ones alive. But do you know what goes into that software? If your answer was sticky tape and glue you clearly work in technology. Congratulations, this article is for you.

Introducing the OpenSSF Scorecard API

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

How to get the most out of GitHub API rate limits

Thinking about using Github's REST API within your system, or already doing so? If you have not already encountered this concept, one important thing to keep in mind while developing is Github's concept of rate limiting.

Why I joined Endor Labs to Build our India Team

Sriram Subramanian recently left his position as VP of Engineering at Citrix to lead the India R&D center at Endor Labs. We asked him what made him take the leap and what's his vision for the India team.

How Zero Trust principles can accelerate open source adoption in enterprises

Open source is a huge boost to productivity, and today we trust it implicitly even if we think we don’t. That comes with a lot of risk, a lot of friction, and doesn’t let us make the most out of open source software. Zero Trust principles can help us get open source adoption to its full potential.

The response is as dangerous as the vulnerability - Thoughts on the CSRB Log4j report

The recent report from the CSRB gives a step by step account of Log4j, from discovery to remediation, and uncovers a painful insight - sometimes the response is just as dangerous as the vulnerability.

What security teams need to know about software development

This article is meant to help security teams begin their threat models and make more informed risk management decisions regarding their software development practices.