vex
3 posts · all writing
The VEX analysis your supplier already did
Your supplier already worked out which CVEs do not apply. Reading their VEX beats retyping it, and that supplier is often the platform team down the hall.
Most of your container CVEs aren't yours
Scan a 35-line Python app and get 292 findings. 219 come from the base image, and none are fixable by changing your code. What the actionable move is.
Your SBOM is half an answer: pair CycloneDX with VEX
An SBOM tells customers what you are made of, and hands them every CVE they can match against you. VEX is the other half, and you have mostly written it.