FOSSA

Identifying and mitigating known vulnerabilities in open source code has long been a foundational part of secure software development. But over the past year, we’ve seen an increase in novel software supply chain attacks happening before CVEs are published. As a consequence, focusing on remediating CVEs — without accounting for other indicators of vulnerable open…