Dependencies

CISA and NCSC's Take on Secure AI Development

A breakdown of the "Guidelines for Secure AI System Development document from CISA and NCSC.

Static SCA vs. Dynamic SCA: Which is Better (and Why it’s Neither)

Software composition analysis (SCA) tools take a static or dynamic approach. Learn the pros and cons of each option and see how the results differ.

Why SCA tools can't agree if something is a CVE

One scanner says this is a CVE, and the other says it's not, who's right?

You found vulnerabilities in your dependencies, now what?

Dependency Resolution in Python: Beware The Phantom Dependency

Phantom dependencies are dependencies used by your code that are not declared in the manifest. If you miss them, they can sneak reachable risks into your application, lead to false positives, or inaccurate SBOMs. All very spooky. This article breaks down how phantom dependencies happen, and how to catch them.

Introducing SCA reachability analysis for Python, Go, and C#

90% of code in modern application is open source, yet only 12% of that code is actually used. Reachability analysis lets us prioritize the risks that can actually impact our applications.

Strengthening Security in .NET Development with packages.lock.json

Make Developers' Lives Easier with Endor Labs & GitHub Advanced Security

Developers are bombarded with information every day. Constant context switching and information overload are among the biggest barriers to productivity. There are simply too many demands for their attention. One day the sales team will understand. Right?

Introducing The Top 10 Open Source Software (OSS) Risks

The Endor Labs Station 9 research team teamed up with over 20 CISOs and CTOs to identify the top 10 security and operational risks introduced through reliance on open source code.

Open Source Licensing Simplified: A Comparative Overview of Popular Licenses

Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project.

What is reachability-based dependency analysis?

As software engineers, we (should) strive to write as little code as possible. This is understandable: new code has new bugs and will need maintenance in the future. One way of avoiding writing software is to reuse Open-Source Software (OSS) libraries, hosted on centralized code repositories, such as Maven or NPM.

What are Maven dependency scopes and their related security risks?

This article explores Maven dependency scopes: what are they, what are they used for, and how do they impact security risks?

Introducing the OpenSSF Scorecard API

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

How Zero Trust principles can accelerate open source adoption in enterprises

Open source is a huge boost to productivity, and today we trust it implicitly even if we think we don’t. That comes with a lot of risk, a lot of friction, and doesn’t let us make the most out of open source software. Zero Trust principles can help us get open source adoption to its full potential.

The response is as dangerous as the vulnerability - Thoughts on the CSRB Log4j report

The recent report from the CSRB gives a step by step account of Log4j, from discovery to remediation, and uncovers a painful insight - sometimes the response is just as dangerous as the vulnerability.