We're struggling with software supply chain security. Looking for automated vulnerability detection tools and sbom generation that don't need source code access. How are you securing software dependencies today?
Ask HN: Best approach to dependency vulnerability scanning in CI?
1–3 of 3 posts
Re: Ask HN: Best approach to dependency vulnerability scanning in CI?
#2We support this with ReARM - https://rearmhq.com/
It's an open-core product (there is an option to self-host FOSS ReARM CE yourself) that gives you per-release vulnerability posture. It consumes various artifacts (e.g., SBOMs) generated during CI phase and does scan on them, doesn't need access to source code. Apart from SBOMs it consumes files with findings from other tools (reports in SARIF format, VDRs, VEXs).
Re: Ask HN: Best approach to dependency vulnerability scanning in CI?
#3[dead]