Layer 1: Source Code Trust Assessment → Review upstream repositories/maintainers/release history
Layer 2: Build Pipeline Integration → CI/CD security gates, signature verification
Layer 3: Artifact Distribution Integrity → Signatures, checksums, SBOM attachment
Layer 4: Runtime Protection → Container scanning, admission control
Layer 5: Continuous Monitoring → Real-time CVE tracking, vulnerability reachability analysis
Layer 6: Incident Response → Supply chain attack emergency response, rollback strategies

Generate SBOM:
□ CycloneDX format: cdxgen → bom.json
□ SPDX format: sbom-tool generate
□ Syft: syft <image|dir> -o spdx-json

Audit Key Points:
□ Are there unknown/unauthorized dependencies?
□ Are there abandoned/no-longer-maintained packages?
□ License conflict detection
□ Direct dependencies vs transitive dependencies list
□ Release timeline and maintainer status of each component

# OSV-Scanner (Free, maintained by Google)
osv-scanner scan -r . --format json

# OWASP Dependency-Track (Enterprise-grade continuous monitoring)
docker run -p 8080:8080 dependencytrack/apiserver
# → Upload SBOM → Automatically match NVD/OSV/GitHub Advisory

# Snyk (Commercial)
snyk test --all-projects
snyk monitor  # Continuous monitoring

# Trivy (Container + Dependency + IaC)
trivy fs .          # File system scanning
trivy image nginx   # Container image
trivy config .      # IaC configuration

SCA alerts ≠ actual risk! Most SCA tools have only ~15% of alerts that are actually reachable.

Verification Steps:
1. Obtain CVE list using Dependency-Track or Trivy
2. Filter vulnerabilities with CVSS ≥ 7.0
3. Conduct reachability analysis for CVEs with PoC
   - Code Property Graph slicing: Track path from user input to vulnerable function
   - DEPTEX method: EPD (Execution Path Dominance) + LLM semantic verification
4. Verify PoC in an isolated environment
5. Prioritize fixes for reachable vulnerabilities based on actual impact

Security Checkpoints:
□ Code submission → pre-commit hook: gitleaks (secret scanning)
□ PR phase → SCA scanning (Trivy/OSV-Scanner)
□ Build phase → Artifact signing (cosign)
□ Push phase → SBOM attachment (syft + attest)
□ Deployment phase → Admission control (OPA/Kyverno + image scanning)
□ Runtime → Continuous vulnerability monitoring (Dependency-Track)

Pipeline Own Security:
□ Pipeline as Code audit (GitHub Actions / GitLab CI configuration injection)
□ Runner isolation (Prevent malicious builds from breaking out of containers)
□ Secret management (Actions Secrets / Vault, prohibit hardcoding)
□ Third-party Action review (Lock commit SHA, not tag)

# Dockerfile audit
hadolint Dockerfile

# Image scanning (Multi-layer: OS + application dependencies + configuration)
trivy image --severity HIGH,CRITICAL nginx:latest

# Minimal base image
# Priority: distroless → alpine → slim → Avoid latest
docker scout quickview nginx:latest

# Image signing
cosign sign --key cosign.key myimage:tag
cosign verify --key cosign.pub myimage:tag

New Dependency Checklist:
□ Maintenance status: Commits in the last 6 months? Maintainer activity?
□ Security history: Malicious code implants in the past?
□ Dependency tree: How many additional transitive dependencies are introduced?
□ License: Compatible with project license?
□ Alternatives: Are there safer alternatives (Snyk Advisor / Socket.dev ratings)?

Risk Assessment Matrix:
  High maintenance × Low dependency count × Compatible license → Low risk
  Low maintenance × High dependency count × License conflict → High risk