supply-chain
6 posts · all writing
The analysis your supplier already did
Your vendor knows which CVEs in their component are actually reachable. They wrote it down. Then you retyped their conclusion into your own config, where it became a decision you are answerable for. Why consuming a VEX document beats copying it, and what the record looks like when the claim keeps its author.
Most of your container CVEs aren't yours: base images and what to do about them
Scan a 35-line Python app and you get 292 findings. 219 of them, three quarters, come from the base image, and not one is fixable by changing your code. Why container scanning produces so much noise, what the actionable move actually is, and how VEX and reachability change the arithmetic.
The license nobody gated on: copyleft in your dependency tree
A CVE is embarrassing and fixable. A copyleft obligation you have been shipping for two years is neither, and you find out during due diligence. How to gate a build on license policy with Trivy or Mend, why permissive licenses should not be findings, and why this belongs on a different threshold from your CVEs.
Threat intelligence in a build pipeline: useful only when it is narrow
Most threat-intel feeds are a firehose aimed at a SOC, and pointing one at a CI job produces noise nobody actions. Scoped to the specific hosts and images you already declared, the same data answers a question no scanner can: what has the outside world already observed about this?
The SBOM you ship is half an answer: pairing CycloneDX with VEX
An SBOM tells your customers what you are made of. Left on its own, it also hands them a list of every CVE they can match against you, and no way to tell which ones matter. The other half is VEX, and most of it is already in your descriptor.
We pointed Draugr at itself: what happens when a security scanner runs its own gate
A security tool has no business gating your code if it can't survive its own gate. So we turned Draugr on Draugr, here's what it found, what we suppressed, and why the suppressions are the interesting part.