Security Insights & Guides
Cut through vulnerability noise. Practical guides for dev teams who ship.
npm Dependency Vulnerability Scanning Guide
npm is the largest dependency ecosystem, and npm audit's CVSS-only output can't tell you which findings attackers are actually exploiting. Learn how EPSS and CISA KEV triage cut through npm's noise and how to build a production-ready npm security workflow.
Snyk Pricing Explained: What It Costs vs GeekWala
Snyk's pricing page lists four tiers and a per-developer model that gets expensive fast. Here's what Snyk actually costs at real team sizes, the free-tier limit teams hit first, and how GeekWala's flat pricing compares.
Snyk vs Dependabot vs Trivy: A Neutral SCA Comparison
We put Snyk, Dependabot, and Trivy through the same 10-point checklist without a vendor holding the pen. One wins on breadth, one wins on cost, one wins on zero setup — none wins everything.
Transitive Dependency Risk: What You Can't See
Your package.json lists a dozen packages; your lockfile resolves over a thousand. Sonatype puts roughly 6 in 7 known vulnerabilities in that transitive layer. Here's how to trace one to its parent and the four ways to actually fix it.
EU CRA Reporting Deadline: September 11, 2026
Most EU Cyber Resilience Act coverage points at the December 2027 deadline. The obligation that lands first — 24-hour reporting of actively exploited vulnerabilities — starts September 11, 2026. Here's what changes, who it applies to, and the SBOM groundwork you need before then.
Most Exploited Vulnerabilities: Q2 2026 Edition
Our quarterly analysis of the most dangerous open-source vulnerabilities, covering April through June 2026. This edition also explains why we moved from a monthly to a quarterly cadence and catches up the gap since March's inaugural report.
Dependency Scanning in GitLab CI and Jenkins
GitLab's built-in dependency scanning is locked behind the Ultimate tier. This guide shows how to build the same PR-gate-plus-scheduled-scan pattern in .gitlab-ci.yml and Jenkinsfile using OSV-Scanner — no license upgrade required.
Vulnerability Scoring Systems Glossary
Five acronyms, five different questions about a vulnerability. This glossary defines CVSS, EPSS, CISA KEV, VEX, and SSVC in plain language, cites each to its maintaining organization, and shows how the five combine into one prioritization decision.
Mend vs Flat-Rate EPSS + KEV Scanning
Mend bundles SCA, container, and license-compliance scanning with per-developer, contact-sales pricing built for large security teams. GeekWala is flat-rate dependency scanning with EPSS and CISA KEV on every finding. Here's an honest, feature-by-feature comparison.
OSV-Scanner vs EPSS Prioritization
OSV-Scanner and GeekWala read the same OSV.dev data, but only one of them scores exploitation probability. Here's how EPSS and CISA KEV change what a CLI table can't show you.
Add a Dependency Security Badge to Your GitHub README
A live badge answers the security question before anyone asks it. Generate your GeekWala badge, embed it with Markdown, HTML, or reStructuredText, and every view links back to a public scan page — no outreach required.
Import a GitHub Repo for Dependency Scanning
Manual manifest uploads work for a one-off check, but repo-connected scanning is what catches the vulnerable package a teammate merges next week. Here's the exact GitHub import flow, the permissions it requests, and what to do when it fails.