Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- DevSecOpsSoftware Supply Chain
Vulnerability management for the modern engineering team
Learn how vulnerability management works, which CVEs need a deadline under CISA BOD 26-04, and why most can be fixed at your next image rebuild.
- DevSecOpsSoftware Supply Chain
CI/CD security best practices: 7 controls and how to test them
Pin actions, scope tokens, isolate runners, and verify artifacts. Seven CI/CD security best practices, each with a check to confirm it blocks what it should.
- Software Supply ChainTools & Buyer’s Guides
What is Chainguard? The trusted source for open source
Chainguard is the trusted source for open source — hardened containers, libraries, VMs, packages, CI, agent skills, and isolated environments for AI agents.
- Tools & Buyer’s GuidesSoftware Supply Chain
8 container security tools compared: Features, tradeoffs, and pricing
Which container security tools fit your stack? Compare eight options by features, drawbacks, pricing, and the maintenance work your team still needs to handle.
- DevSecOpsSoftware Supply Chain
What is a build horizon?
A build horizon sets a maximum age for software artifacts. Learn why it stops CVE buildup and how to enforce it with automated updates, rebuilds, and policy.
- Software Supply Chain
What is Wolfi? Overview and FAQ
Wolfi is a minimal, glibc-based Linux undistro built for containers. Learn how it compares to Alpine, its key features, and how to get started.
- Software Supply ChainDevSecOps
What is Octo STS? Overview and FAQ
Octo STS replaces long-lived GitHub personal access tokens with short-lived, OIDC-federated tokens. Learn how it works, trust policies, and common use cases.
- AppSecSoftware Supply Chain
What is OpenVEX?
OpenVEX tells scanners whether a CVE actually affects your software. Learn how the OpenVEX specification works and how to pair VEX documents with SBOMs.
- Software Supply Chain
What are containers?
Learn what containers are, how they differ from virtual machines, what's inside a container image, and how minimal base images reduce size and CVEs.
- Software Supply Chain
What is the Open Container Initiative (OCI)?
Learn what the Open Container Initiative (OCI) is, how its image, runtime, and distribution specs work, and how to tell if an image is OCI compliant.
- Software Supply Chain
What is melange? Overview and FAQ
melange builds apk packages from source using declarative YAML pipelines. Learn how it works, how it handles multi-arch builds, and how it pairs with apko.
- ComplianceSoftware Supply Chain
CISA Secure Software Development Attestation Form: Requirements and SSDF references
See what the CISA Secure Software Development Attestation Form covers, how each requirement maps to SSDF practices, and why agencies no longer must collect it.