-
Anyone who's delved into/compared using this action versus uploading an SBOM to the dependency submission API?
I'm referring to things like these:
- https://docs.github.com/en/code-security/supply…
MPV updated
10 months ago
-
There was a [USA Cybersecurity Executive Order issued in 2021](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/) that re…
-
We need to add the FASCSA Order Check under the 889 Tool information section in each of the 5 trainings.
Add to this section 'What is Section 889 and how does it apply to purchases?'
Lesson 3 for T…
-
Description: what's your idea?
Impact: Describe the customer impact of the problem. Who will this help? How
will it help them?
Scope: How much effort will this take? ok to provide a range of o…
-
Hi there,
An npm package called 'ing-web' is unrightfully marked as malware: https://github.com/advisories/GHSA-5fx7-hqw3-mg99
However, the malicious code is already removed from the registry for…
-
Heyhey! Love this product idea and want to give it a try. However, I see many examples contain a hash for the version of autofix. I think this is very inconvenient as those hashes are different and I …
-
I'm a Cyber Security researcher and developer of PackjGuard [1] to address open-source software supply chain attacks.
# Issue
During my research, I detected a _deleted package_ in this repository.
…
-
The Trusted Repository Security Initiative Task Force was created from roundtables at the Secure OSS Policy Summit in Washington D.C. in Sept. 2023 and would like to work as a SIG within the Supply Ch…
-
## DISCLAIMER
> This issue may sound exceptionally critical. In fact, it's not. This issue has NO impact on the security of the network, nor does it allow you to print DigiBytes.
# Infinite Supply…
-
during the specification meeting, when reviewing the Terms and Definitions, it was called out that the usage of "provenance" is very specific to NIST and differs from the SLSA,etc definition. while th…