Security Insights & Guides
Cut through vulnerability noise. Practical guides for dev teams who ship.
Supply Chain Attacks: What Scanners Catch in 2026
Dependency scanners catch known CVEs in legitimate packages. Supply chain attacks are different — malicious code injected by attackers who compromise maintainers or publish typosquatted packages. Here's what scanning covers and the defense layers you need for the rest.
What Is Dependency Vulnerability Scanning?
Dependency vulnerability scanning finds known security flaws in your project's third-party packages. This guide covers how scanning works, why CVSS alone isn't enough for prioritization, and how to build a practical workflow across all major ecosystems.
Dependency Security Across 8 Ecosystems
Most teams use 2-3 languages but scan dependencies one ecosystem at a time. This guide maps native audit tools for all 8 major ecosystems and shows what each one misses — plus how to unify scanning across your entire stack.
PHP Dependency Security: Beyond composer audit
composer audit flags PHP vulnerabilities by CVSS severity, but most CVEs are never exploited. Learn how EPSS scoring and CISA KEV data cut through alert fatigue for Laravel, Symfony, and WordPress Composer dependencies.
Free Dependency Scanning Tools 2026 Guide
You don't need an enterprise budget to scan dependencies for vulnerabilities. This is the broadest survey: 7 free tools across every major language, including hosted options like GeekWala, Dependabot, and Trivy alongside CLI-native scanners.
Trivy Container Scan vs EPSS Enrichment
Trivy is a broad infrastructure scanner covering containers, Kubernetes, and IaC. GeekWala is a focused dependency scanner enriching every finding with EPSS exploit probability and CISA KEV status. Here's how the two tools actually detect and prioritize differently.
200 Dependabot Alerts: Which 3 to Fix Today
The average GitHub repository has 67 open Dependabot alerts. Most developers either ignore them all or waste time on low-risk CVEs. The 3-Signal Triage Method — combining CVSS with EPSS and CISA KEV — cuts your actionable list from hundreds to single digits, so you fix what actually matters.
SBOM Requirements 2026: Developer Checklist
The EU CRA vulnerability reporting deadline is September 2026. Here's the checklist your team needs to be ready — organized into two phases with specific action items for each.
SBOM Scanning and the EU Cyber Resilience Act
Starting September 2026, the EU Cyber Resilience Act requires vulnerability and incident reporting for software sold in Europe. By December 2027, you'll need a machine-readable Software Bill of Materials. If your software has open-source dependencies — and it does — this directly affects you.
CVSS, EPSS, KEV, SSVC, and LEV Compared
Five vulnerability scoring systems compete for developer attention: CVSS, EPSS, CISA KEV, SSVC, and LEV. Each answers a different question about risk. This guide compares all five — what they measure, who maintains them, and how to combine the right signals for your team.
Ruby Dependency Security: What bundler-audit Misses
bundler-audit checks ruby-advisory-db and stops there. It won't tell you which gem vulnerabilities are actually being exploited. Learn how EPSS and CISA KEV signals change Ruby dependency prioritization for production Rails apps.
Automated Dependency Scanning: Always-On Monitoring
A CVE drops Tuesday, your scan runs Friday. Three days of exposure. Learn how to set up automated dependency scanning with scheduled scans, smart alert routing via EPSS, and webhook notifications for real-time CVE monitoring.