Subscribe

Pillar

Supply Chain

Supply chain security is the lockfile, the attestations, the CI that signed something, and the dependency you did not mean to trust. It is not a sticker on a container image.

SBOM tools

Name what you installed

Open the list

SCA tools

Name the vulnerable package you already installed

Open the list

Questions about Supply Chain

What will the supply-chain lists cover?

SCA that fails the build on a rule you wrote, lockfiles that cannot silently float, CI attestations you can verify later, and pinning that does not require a hero on Friday night. If the tool only produces a PDF, it will not make the first list.

Is this the same as application security?

AppSec is the sink in your code. Supply chain is the code you did not write and the pipeline that shipped it. A perfect encoder will not save you from a tainted installer. Different lists.

Will you list Sigstore and SLSA?

As rows on an attestations list, when we can show a verify step you can run, not as a standards shrine. The job is ‘prove this artifact,’ not ‘mention SLSA level 3.’