Tag: #sbom

한국어English日本語中文

← All posts

• Dependency Supply Chain Security — The Things a Lockfile Does Not Block

  You wrote a dozen or so packages into package.json, yet more than a thousand get installed. This post explains why transitive dependencies are riskier than direct ones, and uses a real lockfile entry to show why an integ

  2026-07-26 · 14 min read #security#supply-chain#npm#sbom#ci

• Container & Supply-Chain Security in 2026 — Trivy / Grype / Snyk / Sysdig / Tetragon / Falco / Cosign / Sigstore Deep Dive

  After the 2024 xz backdoor and the 2025 entry into force of the EU Cyber Resilience Act, container supply-chain security is no longer "scan and forget". This is a May 2026 map of the full stack — Trivy/Grype/Snyk/Sysdig

  2026-05-25 · 26 min read #container-security#trivy#grype#snyk#sysdig

• Software Supply Chain Security 2026 — Sigstore, SLSA, SBOM (CycloneDX/SPDX), Chainguard Images, Socket.dev, JFrog Xray, Snyk Open Source, GUAC, in-toto, GitHub Actions OIDC Deep Dive

  As of May 2026, software supply chain security is no longer optional. The 2020 SolarWinds Orion breach, the 2021 Log4Shell crisis, the March 2024 XZ Utils backdoor (the Jia Tan affair), and the steady drumbeat of npm and

  2026-05-16 · 31 min read #software-supply-chain#sigstore#slsa#sbom#cyclonedx

• Container & Kubernetes Security Scanning 2026 Complete Guide - Trivy, Grype, Snyk Container, Anchore, Clair, Falco, Kubescape, Datree, Polaris, Tetragon Deep Dive

  A complete map of the container and Kubernetes security scanning ecosystem as of May 2026. Covers image vulnerability scanners (Trivy 0.58, Grype, Syft, Clair v4, Snyk Container), eBPF runtime security (Falco, Tetragon,

  2026-05-16 · 23 min read #english#container-security#kubernetes-security#trivy#grype

• Container Registries in 2026 — Docker Hub / GHCR / ECR / Harbor / Quay / Zot / Cosign + Sigstore Deep Dive

  In 2026, container registries are no longer just a docker push away. Following Docker Hub pricing changes, GHCR has effectively become the OSS standard. Harbor has matured into the self-hosting default as a CNCF graduate

  2026-05-16 · 27 min read #container#registry#docker-hub#ghcr#ecr

• Cloud Security 2026 Complete Guide - Zero Trust, SBOM/SLSA, CSPM/CNAPP, Wiz, Falco, Sigstore, Vault, Tailscale, Cloudflare Deep Dive

  A complete look at the cloud security stack as of May 2026. Zero Trust (Cloudflare, Tailscale, Zscaler, Netskope), CSPM/CNAPP (Wiz, Orca, Lacework, Prisma Cloud, Sysdig, Aqua), SBOM/SLSA supply chain (Sigstore cosign, Cy

  2026-05-16 · 22 min read #cloud-security#zero-trust#sbom#slsa#cspm

• Static Analysis / SAST 2026 — Semgrep / CodeQL / Snyk / SonarQube / Aikido / Trivy Deep Dive

  Mapping the 2026 code security tooling landscape — Semgrep (the de facto OSS SAST plus Pro engine and Supply Chain), CodeQL (the heart of GitHub Advanced Security, dataflow king), Snyk Code (SAST+SCA after the DeepCode A

  2026-05-15 · 26 min read #security#sast#static-analysis#semgrep#codeql

• Container & Cloud-Native Security in 2026 — Trivy vs Grype vs Snyk vs Aikido vs Wiz vs Sysdig vs Tetragon Deep Dive (Shift-Left to Runtime)

  There are too many container security tools now. Scanners (Trivy, Grype, Snyk), AppSec plus Cloud integrations (Aikido), CNAPP leaders (Wiz, Orca), runtime detection (Sysdig Falco, Tetragon), artifact-side (JFrog Xray),

  2026-05-14 · 22 min read #container-security#trivy#snyk#aikido#wiz

• Frontend CI/CD & Deployment 2025 — GitHub Actions, Turborepo, Vercel, Netlify, Cloudflare, Preview, Canary, Feature Flags, SLSA/SBOM (S6 E12)

  CI/CD for frontend is no longer "build and ship." It is caching, preview environments, canary rollouts, feature flags, supply-chain attestation (SLSA/SBOM), and rollback-first thinking. This guide compares GitHub Actions

  2026-04-15 · 7 min read #frontend#ci-cd#deployment#github-actions#turborepo

• Container Security & Supply Chain Complete Guide 2025: Image Scanning, Sigstore, SBOM, Runtime Security

  Everything about container security! Image scanning (Trivy/Grype/Snyk), image signing (Sigstore/cosign), SBOM (CycloneDX/SPDX), runtime security (Falco/Tetragon), Pod Security Standards, Network Policy, Seccomp/AppArmor,

  2026-04-14 · 15 min read #container-security#supply-chain#image-scanning#sigstore#sbom

• The Complete DevSecOps Guide 2025: Shift-Left Security, SAST/DAST/SCA, Container Security

  Everything about DevSecOps! Shift-Left security strategy, SAST (SonarQube/Semgrep), DAST (ZAP/Burp), SCA (Snyk/Dependabot), Container security (Trivy), Supply chain security (SBOM/SLSA), Secret detection, GitHub Actions

  2026-03-24 · 20 min read #devsecops#security#shift-left#sast#dast

• Container Image Security and Software Supply Chain Protection: A Practical Guide to Trivy, Cosign, SBOM, and Sigstore

  A comprehensive guide to the full container image security lifecycle. From vulnerability scanning with Trivy, image signing with Cosign/Sigstore, SBOM generation and management, to the SLSA framework -- implement product

  2026-03-13 · 15 min read #devops#container-security#trivy#cosign#sbom