supply-chain
5 posts · all writing
The VEX analysis your supplier already did
Your supplier already worked out which CVEs do not apply. Reading their VEX beats retyping it, and that supplier is often the platform team down the hall.
Most of your container CVEs aren't yours
Scan a 35-line Python app and get 292 findings. 219 come from the base image, and none are fixable by changing your code. What the actionable move is.
The license nobody gated on: copyleft in your tree
A CVE is embarrassing and fixable. A copyleft obligation you shipped for two years is neither, and you find out during due diligence. How to gate on it.
Threat intelligence in a build pipeline
A SOC firehose pointed at a CI job produces noise nobody actions. Scoped to the hosts and images you declared, it answers what the outside world has seen.
Your SBOM is half an answer: pair CycloneDX with VEX
An SBOM tells customers what you are made of, and hands them every CVE they can match against you. VEX is the other half, and you have mostly written it.