Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- Compliance
What is FIPS? A guide to compliance and verification
Learn who needs FIPS compliance, why a validated module alone isn't enough, and what to verify in containers after the FIPS 140-3 transition.
- Tools & Buyer’s GuidesSoftware Supply Chain
8 container security tools compared: Features, tradeoffs, and pricing
Which container security tools fit your stack? Compare eight options by features, drawbacks, pricing, and the maintenance work your team still needs to handle.
- Software Supply ChainDevSecOps
What is Octo STS? Overview and FAQ
Octo STS replaces long-lived GitHub personal access tokens with short-lived, OIDC-federated tokens. Learn how it works, trust policies, and common use cases.
- Compliance
CMMC 2.0 practices and domains
See all 14 CMMC 2.0 practice domains, how practices are named and numbered, and how Level 1's 17 and Level 2's 110 practices map to NIST SP 800-171.
- AppSecSoftware Supply Chain
What is OpenVEX?
OpenVEX tells scanners whether a CVE actually affects your software. Learn how the OpenVEX specification works and how to pair VEX documents with SBOMs.
- Software Supply Chain
What is Wolfi? Overview and FAQ
Wolfi is a minimal, glibc-based Linux undistro built for containers. Learn how it compares to Alpine, its key features, and how to get started.
- Compliance
Understanding FIPS: Standards, validation, and compliance
Learn what FIPS is, who needs FIPS validation, how CMVP validation works, and what approved algorithms and cryptographic boundaries mean for compliance.
- Software Supply Chain
What is melange? Overview and FAQ
melange builds apk packages from source using declarative YAML pipelines. Learn how it works, how it handles multi-arch builds, and how it pairs with apko.
- Software Supply Chain
What are containers?
Learn what containers are, how they differ from virtual machines, what's inside a container image, and how minimal base images reduce size and CVEs.
- AppSec
What are software vulnerabilities and CVEs, and why do they matter?
Learn what makes a software vulnerability, how the CVE Program, CVSS, and CWE score them, and why unpatched CVEs put your data and compliance at risk.
- ComplianceAppSec
What are CIS Benchmarks?
Learn what CIS Benchmarks are, how Level 1 and Level 2 profiles work, and how the CIS Docker Benchmark applies to hardening container images for compliance.
- Software Supply Chain
What is the Open Container Initiative (OCI)?
Learn what the Open Container Initiative (OCI) is, how its image, runtime, and distribution specs work, and how to tell if an image is OCI compliant.