Supply Chain Security 101

Everything you need to know about software supply chain security in the age of open source.

Articles

• How to scale DevSecOps automation with shared workflows
  A merged update PR isn’t a fix in production. Decide which DevSecOps automation to share, who owns each part, and how to pilot it before adding teams.

• MCP security: How to evaluate an MCP server before rollout
  A legitimate MCP server can still return malicious instructions. This MCP security guide shows how to scope its access and test what an assistant can send.

• What is Octo STS? Overview and FAQ
  Octo STS replaces long-lived GitHub personal access tokens with short-lived, OIDC-federated tokens. Learn how it works, trust policies, and common use cases.

• SBOMs vs. attestations: What's the difference?
  An SBOM lists what's in your software, and an attestation proves who built it and how. Learn the difference and when to use cosign attest vs. cosign attach.

• What is a build horizon?
  A build horizon sets a maximum age for software artifacts. Learn why it stops CVE buildup and how to enforce it with automated updates, rebuilds, and policy.

• GitHub Actions alternatives: 8 ways to replace or secure unvetted actions
  Compare 8 alternatives to unvetted GitHub Actions, including hardened drop-in replacements, SHA pinning, GitLab, CircleCI, and Buildkite, for secure CI/CD.

• npm supply chain attacks: How to audit your dependency controls
  Reduce the risk of npm supply chain attacks. Trace a package’s path into your build, verify its artifact, and control what can execute.

• What is dependency confusion? How to reduce the risk of attack
  Dependency confusion tricks a build into installing a malicious public package instead of a private one. Learn the controls that reduce the risk.

• CI/CD security: A practical guide to trusted pipelines
  Secure CI/CD pipelines from dependency confusion, tag hijacking, and secret leaks. Learn key controls like pinned actions and build provenance.

• What is container runtime security?
  Understanding container runtime security best practices can help protect your critical applications against threats to your containerized applications.

• Attack Surface Management (ASM): Best practices guide
  Learn what attack surface management is, why it matters, and how to reduce risk with modern tools and best practices.

• Managing risk in the software supply chain
  Secure your product by understanding risk factors in complex software supply chains, and best practices for mitigating common security vulnerabilities.