supply-chain-security

There are 5 repositories under supply-chain-security topic.

slsa-framework / slsa
Supply-chain Levels for Software Artifacts
devops security supply-chain-security
Language:Shell 1418
guacsec / guac
GUAC aggregates software security metadata into a high fidelity graph database.
security software-supply-chain software-supply-chain-security supply-chain supply-chain-security supply-chain-visibility supply-chain-analytics
Language:Go 1174
tern-tools / tern
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
compliance containers dependencies docker metadata-extraction open-source oss-compliance python risk-management sbom software-composition-analysis spdx supply-chain-security tool
Language:Python 930
Legit-Labs / legitify
Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets
supply-chain-security security-scanner sdlc-security devops security devsecops ci github gitlab golang
Language:Go 706
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
compliance containers cve cyclonedx dependency-analysis dependency-audit devsecops reachability-analysis risk-audit sbom sca security-audit security-tools supply-chain-security vex vulnerability-scanners
Language:Python 697
ossillate-inc / packj
Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
malware npm pypi python security security-audit security-tools vulnerability rubygems supply-chain-security malware-analysis static-analysis vulnerability-scanners dynamic-analysis sandboxing devops developer-tools devops-tools devsecops supply-chain
Language:Python 614
step-security / harden-runner
Network egress filtering and runtime security for GitHub-hosted and self-hosted runners
github-actions actions supply-chain-security hardening security-hardening runners egress-filtering network-security runtime-security
Language:TypeScript 488
kpcyrd / rebuilderd
Independent verification of binary packages - reproducible builds
reproducible-builds rebuilder supply-chain-security security-tools rust supply-chain
Language:Rust 344
chainloop-dev / chainloop
Chainloop is an Open Source Metadata Vault for your Software Supply Chain metadata, SBOMs, VEX, SARIF files, QA reports, and more.
compliance cyclonedx devsecops sbom sbom-distribution security spdx supply-chain-security metadata-platform sbom-discovery license open-source-licensing ospo oss-compliance regulated-industry attestation in-toto slsa slsa-provenance
Language:Go 303
bureado / awesome-software-supply-chain-security
A compilation of resources in the software supply chain security domain, with emphasis on open source
reproducible-builds supply-chain-security devsecops vulnerability-scanning security-vulnerability vulnerability-management supply-chain-attacks sbom package-management dependency-management static-analysis software-composition-analysis oss-compliance software-supply-chain software-supply-chain-security dependencies cve-scanning attestation awesome-list
251
step-security / secure-repo
Orchestrate GitHub Actions Security
actions github github-actions golang security security-tools supply-chain-security workflow
Language:Go 234
docker / scout-cli
Docker Scout CLI
docker security supply-chain-security
Language:Shell 202
NodeSecure / js-x-ray
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
security security-tools security-audit ast-analysis ast javascript nodejs sast supply-chain-security
Language:JavaScript 196
ckotzbauer / sbom-operator
Catalogue all images of a Kubernetes cluster to multiple targets with Syft
sbom kubernetes k8s operator supply-chain-security
Language:Go 179
vet
safedep / vet
Tool to achieve policy driven vetting of open source dependencies
devsecops security supply-chain-security policy-as-code software-composition-analysis
Language:Go 173
mbalabash / sdc-check
Small tool to inform you about potential risks in project dependencies list
npm security audit supply-chain-security
Language:TypeScript 138
cugu / gocap
List your dependencies capabilities and monitor if updates require more capabilities.
go supply-chain-attacks supply-chain-security
Language:Go 130
interlynk-io / sbomqs
SBOM quality score - Quality metrics for your sboms
golang cyclonedx spdx sbom sbom-examples sbom-tool go sbom-quality sbom-score sbom-samples devsecops-pipeline security-tools supply-chain-security
Language:Go 130
kpcyrd / sh4d0wup
Signing-key abuse and update exploitation framework
backdoor-factory exploitation hacking penetration-testing redteaming supply-chain-security
Language:Rust 118
vishalgarg-sec / Software-Supply-Chain-Security
A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.
attestations cncf dependency-management open-source-security openssf owasp sbom slsa software-bill-of-material software-security software-supply-chain-security software-transparency supply-chain-attacks supply-chain-security vex vulnerability-management
110
oracle / macaron
Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks or check conformance to frameworks, such as SLSA.
build-system cicd integrity-protection malware-detection sbom slsa supply-chain-security
Language:Python 106
kpcyrd / pacman-bintrans
Experimental binary transparency for pacman with sigstore and rekor
archlinux binary-transparency security supply-chain supply-chain-security
Language:Rust 83
boostsecurityio / lotp
boostsecurityio/lotp
lotp supply-chain-security living-off-the-pipeline
Language:HTML 78
CycodeLabs / cimon-action
Runtime Security Solution for your CI/CD Pipeline
github-actions security cicd hardening security-hardening supply-chain-security ebpf linux
Language:JavaScript 72
codetotal
oxsecurity / codetotal
Analyze any snippet, file, or repository to detect possible security flaws such as secret in code, open source vulnerability, code security, vulnerability, insecure infrastructure as code, and potential legal issues with open source licenses.
code-quality-analyzer iac megalinter sast secrets-detection security supply-chain sbom sbom-generator vulnerability-scanners supply-chain-security
Language:TypeScript 67
docker / scout-action
Docker Scout GitHub Action
docker security github-actions supply-chain-security
Language:JavaScript 60
owasp-dep-scan / blint
BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.
binary cyclonedx depscan fuzzing malware sbom supply-chain-analytics supply-chain-security
Language:Python 60
mchmarny / s3cme
Template Go app repo with local test/lint/build/vulnerability check workflow, and on tag image test/build/release pipelines, with ko generative SBOM, cosign attestation, and SLSA build provenance
attestation oidc provenance sbom slsa supply-chain-security vulnerability cosine
Language:Go 46
chainalert-github-action
Checkmarx / chainalert-github-action
scans popular packages and alerts in cases there is suspicion of an account takeover
supply-chain-security github-action free-service
Language:JavaScript 40
meta-fun / awesome-software-supply-chain-security
Sharing software supply chain security open source projects
security security-tools supply-chain-security supply-chain sbom sast cicd kubernetes devops software-supply-chain software-supply-chain-security vulnerability-scanner software-composition-analysis dependency-analysis
37
kpcyrd / repro-env
Dependency lockfiles for reproducible build environments 📦🔒
release-engineering reproducible-builds supply-chain-security
Language:Rust 33
0x2E / go-build-hijacking
Insert payload through the program set by -toolexec. Just a toy
golang supply-chain-security
Language:Go 26
BretFisher / container-security-steps
Docker and Kubernetes security steps to help you create, build, test, and run safer in containers
devops devsecops docker kubernetes security-automation security-tools supply-chain-security
26
boostsecurityio / poutine
boostsecurityio/poutine
ci cli devops devsecops gh-extension github github-actions golang security security-scanner supply-chain supply-chain-security
Language:Go 25
kpcyrd / backseat-signed
Authenticate the cryptographic chain-of-custody of Linux distributions (like Arch Linux and Debian) to their source code inputs
chain-of-custody supply-chain-security
Language:Rust 25
testifysec / solarsploit
Red team tool that emulates the SolarWinds CI compromise attack vector.
security security-tools supply-chain-security compiler
Language:Go 22

supply-chain-security

slsa-framework / slsa

guacsec / guac

tern-tools / tern

Legit-Labs / legitify

owasp-dep-scan / dep-scan

ossillate-inc / packj

step-security / harden-runner

kpcyrd / rebuilderd

chainloop-dev / chainloop

bureado / awesome-software-supply-chain-security

step-security / secure-repo

docker / scout-cli

NodeSecure / js-x-ray

ckotzbauer / sbom-operator

safedep / vet

mbalabash / sdc-check

cugu / gocap

interlynk-io / sbomqs

kpcyrd / sh4d0wup

vishalgarg-sec / Software-Supply-Chain-Security

oracle / macaron

kpcyrd / pacman-bintrans

boostsecurityio / lotp

CycodeLabs / cimon-action

oxsecurity / codetotal

docker / scout-action

owasp-dep-scan / blint

mchmarny / s3cme

Checkmarx / chainalert-github-action

meta-fun / awesome-software-supply-chain-security

kpcyrd / repro-env

0x2E / go-build-hijacking

BretFisher / container-security-steps

boostsecurityio / poutine

kpcyrd / backseat-signed

testifysec / solarsploit