Why a Green Dependency Scan Doesn’t Mean You’re Fully Covered
Tools like Trivy, Syft, and Grype are useful, but a single successful scan only tells you what was known at that moment. If a new CVE is published…
dependency security
A Green Dependency Scan Doesn't Mean You're Covered
Security scanners are useful, but a single successful scan in CI only tells you that the dependencies looked acceptable at that moment. If a new CVE is published…
What’s a practical way to reduce JavaScript supply-chain risk?
I'm relatively new to modern JavaScript development and have become concerned about the number of dependencies pulled into even a small Nuxt frontend. I switched from Node to…