Blog

An SBOM without VEX is like peanut butter without jelly. SBOM is a top buzzword in cybersecurity, but it's important to understand why VEX (Vulnerability Exploitability eXchange) is such a critical companion document.

Join Henrik to learn how his journey into Go programming turned into a path of malicious OSS packages.

Naming and understanding the attack vectors at the disposal of our adversaries.

Endor Labs and Intuitive.Cloud announce strategic partnership and investment with the goal of taking on OSS sprawl.

Reachability analysis increases reliability of SCA results, allowing teams to quickly prioritize just the risks that matter.

This article explores Maven dependency scopes: What are they, what are they used for, and how do they impact security risks?

This blog summarizes highlights from Tragedy of the Digital Commons, by Strauss Center scholar and lecturer Chinmayi Sharma, where she shares the OSS state of affairs and her thoughts on improving security.

Program analysis is the process of checking whether or not a piece of software fulfills certain properties. This article explores the basics of program analysis, so we could then dive deeper into the world of call graphs.

After a comprehensive diligence process on startups in the supply chain and open source security space, over 30 CISOs have chosen to personally back Endor Labs.

Endor Labs raises $25M seed round.

Solution from category-defining entrepreneurs and world-renowned experts helps developers spend less time dealing with security issues, more time accelerating their development through safe code reuse.

Do you know what goes into the software your company consumes? If your answer was sticky tape and glue, you clearly work in technology. Congratulations, this article is for you.

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

Thinking about using Github's REST API within your system, or already doing so? If you have not already encountered this concept, one important thing to keep in mind while developing is Github's concept of rate limiting.

Sriram Subramanian recently left his position as VP of Engineering at Citrix to lead the India R&D center at Endor Labs. We asked him what made him take the leap and what's his vision for the India team.

Learn how Zero Trust principles help OSS adoption

Learn how to begin threat models and make more informed risk management decisions regarding their software development practices.

The recent report from the CSRB gives a step by step account of Log4j, from discovery to remediation, and uncovers a painful insight - sometimes the response is just as dangerous as the vulnerability.

In this article, we explore the impact of using a monorepo vs a polyrepo architecture on dependency management.