sbom
3 posts · all writing
The VEX analysis your supplier already did
Your supplier already worked out which CVEs do not apply. Reading their VEX beats retyping it, and that supplier is often the platform team down the hall.
The license nobody gated on: copyleft in your tree
A CVE is embarrassing and fixable. A copyleft obligation you shipped for two years is neither, and you find out during due diligence. How to gate on it.
Your SBOM is half an answer: pair CycloneDX with VEX
An SBOM tells customers what you are made of, and hands them every CVE they can match against you. VEX is the other half, and you have mostly written it.