Can we talk about how nobody scans a dependency file until it's too late?

My brother in law does security for a bank in Charlotte and last week he showed me how their team runs a software bill of materials scan on every build, not just once at the end. I used to think that was overkill and that a yearly audit with a scanner like OWASP Dependency-Check was plenty. Then he walked me through a repo where a tiny logging library got flagged three months before anyone could have found it by hand. I changed my mind that night. How often are you running scans on your side, and do you do it per commit or just before release?

1 comments

Log in to join the discussion

Log In

1 Comment

blairtaylor6d ago

That logging library thing is real. We had a jackson-databind CVE sit in our repo for close to four months because our only scan ran during the release checklist. Now the build fails if the scan finds anything with a CVSS over 7, and honestly the noise at first was brutal (like 30 alerts on day one, most of them false). We run it on every PR now and it takes maybe 90 seconds, which is nothing compared to the two days we lost patching that one mess. Per release is way too late, per commit or per PR is the sweet spot.

10