Supply-chain security
SBOMs, signed builds and dependency hygiene — the groundwork for the Cyber Resilience Act.
Attackers increasingly come in through what you build with: a poisoned package, a hijacked maintainer, a tampered build script. We secure the path from source to release — pinned and reviewed dependencies, SBOMs generated in every build, signed artefacts with provenance, and a hardened CI — so you can prove what is inside your product and spot when something changes that shouldn’t.
01 / What it solves
CycloneDX or SPDX bills of materials generated automatically, versioned with each release and ready for customers and regulators.
Artefacts and container images signed with Sigstore, with build provenance that shows how and from what they were made.
Lockfiles, pinned versions and a review step for new packages and their install scripts — before they reach your build.
Least-privilege pipeline tokens, short-lived cloud credentials, protected branches and alerts on changes to build and config files.
02 / Stack
Industry-standard, boring in the good way: tools with a future, that the next engineer will know too.
SBOM & inventory
CycloneDX / SPDX
Standard SBOM formats
Syft
SBOM generation for code and images
Dependency-Track
Component inventory and vulnerability tracking
Signing & provenance
Sigstore / cosign
Keyless signing of artefacts and images
SLSA
Build-integrity levels and provenance
in-toto attestations
Verifiable statements about each build step
Scanning
OSV-Scanner
Known vulnerabilities in dependencies
Trivy / Grype
Image and filesystem scanning
Gitleaks
Secrets that slipped into source code
CI & repositories
GitHub Actions / GitLab CI
Pinned actions, scoped tokens, OIDC to the cloud
OpenSSF Scorecard
Security health of repositories and dependencies
Renovate / Dependabot
Controlled, reviewed dependency updates
03 / Approach
SBOMs, scans and signatures run in the pipeline, not in a spreadsheet before release.
A person looks at new dependencies and install scripts; routine updates flow through automatically.
Component inventory and vulnerability handling that map onto what the Cyber Resilience Act expects from manufacturers.
Unexpected edits to build scripts, config files and lockfiles raise an alert instead of slipping through review.
04 / Standards
We adhere to industry standards and proven methods on every project — they are what makes the estimate hold.
05 / Infrastructure
Good questions
Straight answers to what buyers ask before they start.
An attack that reaches you through something you build with rather than through your own code: a compromised or typo-squatted package, a hijacked maintainer account, a tampered build tool or CI secret. Several such attacks in recent years delivered malware through install scripts and build configuration.
Related work
Projects and products of ours that involved this service.
Start
Tell us how you build and release today. A senior engineer writes back with an honest scope and price.
Let’s manage See IoT security
