OWASP Top 10 (opens in a new tab)
The official reference for the tools used in this lesson.
Link
Dependency and supply chain risk
Most of your production code came from someone else. Lockfiles, audits, and update discipline are what keep that manageable.
Lesson 4.313m 44sIntermediate5.7k students
Chapters
13:44- 0:00Introduction: What is SCA?
- 0:36How Software Composition Analysis Works
- 2:45Real-World Example: Log4j Vulnerability
- 4:00Understanding SBOMs (Software Bill of Materials
- 5:45How Vulnerabilities Are Tracked (CVEs Explained
- 6:45Demo: Scanning with Trivy
- 9:30False Positives and Reachability
- 10:30Aikido Security Demo & Fixing Vulnerabilities
What this lesson covers
- Pin dependencies with a committed lockfile
- Audit for known vulnerabilities continuously
- Review what a new dependency actually pulls in
This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will
- Pin dependencies with a committed lockfile
- Audit for known vulnerabilities continuously
- Review what a new dependency actually pulls in
Resources
Personal notes are coming soon.