How to integrate SBOMs into the software development life cycle
4 minute read time
Discover strategies for incorporating software bills of materials (SBOMs) into your software development life cycle (SDLC)
Read More...
Are unnecessary vulnerabilities polluting your software supply chain?
7 minute read time
As malicious software supply chain attacks continue to evolve, so do the ways that bad actors exploit vulnerable libraries.
Read More...
How is the Sonatype Safety Rating determined?
1 minute read time
The Sonatype Safety Rating is an aggregate rating designed to estimate the likelihood of an open source project containing security vulnerabilities.
Read More...
Introducing our 8th annual State of the Software Supply Chain
2 minute read time
Announcing the arrival of our 8th Annual State of the Software Supply Chain Report looking at managing open source security, industry trends, and more.
Read More...
Despite what some vendors say, please don't ignore Log4j
5 minute read time
Ignoring Log4j and recommending that high-risk open source vulnerabilities be left in application code isn't just irresponsible, it's dangerous.
Read More...
One of the most tangible ways to improve software is writing and maintaining good source code, but how do you make that part of your process?
Read More...
Prioritizing open source vulnerabilities: Is reachability useful?
8 minute read time
Good software composition analysis (SCA) can reduce open source risk, but poor results slows development. Can prioritization based on reachability help?
Read More...