Software supply chain and infrastructure-as-code security
Most modern applications are mostly other people's code: open-source libraries, base container images and infrastructure templates. A flaw or a poisoned package in any of them becomes your problem. Supply chain security means knowing what is in your software, checking it before it ships and being able to say so to a customer or an insurer.
What we do
- Build pipeline security gates
- SBOM creation and storage
- Container base image policy
- Terraform and cloud template review
- Secret scanning and rotation
- Dependency update process
- Vendor SBOM review
We work with Semgrep for static analysis of source code, Trivy for vulnerabilities and misconfigurations in container images and repositories, Checkov for Terraform and cloud templates, and Syft to produce a software bill of materials in SPDX or CycloneDX format. Sigstore signing lets a build prove where an artifact came from. Our team wires these into the build pipeline so findings block risky changes instead of arriving in a report later.
This group links to our Cybersecurity, Cyber Automation and Tailored Software practices. A scanner reports known issues, not unknown ones, so it complements manual code review and penetration testing. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Semgrep
- Trivy
- Checkov
- Syft
- Sigstore
- Snyk
- Dependabot
Platforms and practices
- Semgrep static analysis rules
- Trivy image and repository scanning
- Checkov Terraform and template checks
- SBOM generation with Syft
- SPDX and CycloneDX formats
- Sigstore artifact signing
- Secret scanning in repositories and history
- Pipeline gates and exception handling
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Software supply chain and infrastructure-as-code security for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCyber Automation
Custom AI agents that do repetitive work around the clock, with human review where it matters.
Learn moreTailored Software
Software built around your business in weeks, and you own the code.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat is a software bill of materials, and do we need one?
A software bill of materials (SBOM) is a machine-readable list of the components inside a piece of software, in a format such as SPDX or CycloneDX. Customers, insurers and some contracts now ask for one, and it lets you check quickly whether a newly announced flaw affects you. A tool such as Syft can generate it from the build. An SBOM lists what is there. It does not say whether the component is vulnerable.
Will these scanners stop a malicious package?
Not on their own. Scanners such as Trivy match components against known vulnerability data, and Semgrep finds risky patterns in your own code. A newly published malicious package may not be in any database yet. We reduce the exposure by pinning versions, using a private mirror or lockfiles, reviewing new dependencies, and verifying build provenance, for example with Sigstore signatures.
Will scanning slow our developers down?
It can if it is done badly. We tune the rules so the pipeline blocks only on findings that matter, such as a critical flaw with a fix available or a public storage bucket in a Terraform change, and we route the rest to a backlog with an owner. Checks run on the pull request, where the fix is cheapest.
Does Checkov or Trivy check our live cloud accounts?
Checkov mainly reads infrastructure-as-code files such as Terraform before they are applied, and Trivy examines images and repositories. Neither replaces checking the running cloud account, because settings can be changed by hand after deployment. We pair them with account-level checks and with drift detection.