domains / families / security / supply-chain-security

supply-chain-security

authentic

Software supply-chain security assessment: SBOM generation, SCA scanning, CI/CD pipeline review, container image audit, build integrity, dependency provenance, and vulnerability reachability verification.

When to use

• Auditing how software is built, packaged, and depended upon.
• Verifying whether a disclosed CVE is actually reachable in a project.

When not to use

• SBOM completeness depends on ecosystem tooling maturity.
• Reachability analysis is heuristic; manual confirmation advised.

Skill page

Source