Ask HN: Best approach to dependency vulnerability scanning in CI?

3 pointsusman_oiu1 comment

We're struggling with software supply chain security. Looking for automated vulnerability detection tools and sbom generation that don't need source code access. How are you securing software dependencies today?

View on HN

We support this with ReARM - https://rearmhq.com/

It's an open-core product (there is an option to self-host FOSS ReARM CE yourself) that gives you per-release vulnerability posture. It consumes various artifacts (e.g., SBOMs) generated during CI phase and does scan on them, doesn't need access to source code. Apart from SBOMs it consumes files with findings from other tools (reports in SARIF format, VDRs, VEXs).

Reply on news.ycombinator.com