Observations, analysis and practice on software supply chain security, open-source governance and AI security.
Industry reports keep finding that the vast majority of codebases contain open-source components years out of date. Abandoned components get no patches and no one answers vulnerability reports — the most overlooked supply-chain risk. How to identify, grade and remediate.
The hard part of license risk is not any single license but combinations — GPL inside proprietary code, Apache-2.0 meeting GPLv2, declarations that don't match the files. Five common conflict patterns and a four-tier remediation playbook, all automatable.
China's five-regulator joint opinion made open-source governance a compliance obligation for financial institutions. We unpack the four regulatory keywords and lay out a working framework of inventory, admission, monitoring and incident response.
Of the two-thousand-plus open-source licenses, which ones actually deserve enterprise caution? A four-tier map by contagion — permissive, weak copyleft, strong copyleft, and commercial-restriction clauses — plus a three-step governance rollout.
Supply-chain poisoning is spreading from npm packages to MCP servers and Agent Skills. A review of xz, Shai-Hulud and postmark-mcp — and why malware detection is no longer enough.
Studies keep finding that roughly 40% of AI-generated code contains exploitable flaws — while developers using AI assistants feel more confident. The data, four mechanisms, and a governance path.
The CRA is in force: vulnerability-reporting obligations start September 2026, full application in December 2027, with fines up to €15M or 2.5% of global turnover. A six-point checklist.
The gap between SCA tools isn't the feature list — it's the detection principle. Manifest-level trusts what you declare; snippet-level verifies what you actually shipped. Five blind spots and an evaluation checklist.
SPDX, CycloneDX or SWID? US EO 14028, FDA, the EU CRA and China's financial-sector rules — what they require, and a four-step path from generation to operations.
As code is mass-produced by AI and dependencies are pulled in automatically by agents, the old "scan-and-inventory" paradigm starts to break. Security has to move from after-the-fact to the moment of production.
Many teams treat an SBOM as a document to hand in. But a valuable SBOM drives decisions — which vulns are exploitable, which dependency to fix first, which license carries risk.
