https://stacklok.com

Stacklok | Bringing software supply chain security to developersSoftware is eating the world. Hostile, sophisticated actors will ultimately eat the software industry if left unchecked. We build open source software that developers love, which in turn makes the world a safer place for all.Stacklok | Bringing software supply chain security to developers Home Products Minder A software security platform for open source developers and communities Trusty A free-to-use service to help developers vet the supply chain risk of OSS packages Company About Careers Open Source Press Resources Resources Blog Videos Trusty Docs Minder Docs View all resources Featured Content Blog Unlocking secure software distribution with Minder and GitHub Artifact Attestations Blog Announcing the Proof-of-Diligence (PoD) algorithm: A method of modeling trust and maintainability in open source ecosystems Software Supply Chain Security (S3C) Weekly Explore our weekly newsletter on software supply chain security, featuring incidents, tips, tools, and community updates. Powered by Stacklok. Subscribe Now Contact Login Get Started For DevelopersVet the supply chain risk of open source packagesTrusty is a free-to-use web app that provides data and scoring on the supply chain risk for open source packages. Get Started with Trusty For Open Source CommunitiesSecure your software supply chainMinder is a supply chain security platform that helps you build more secure software and attest to your security practices. Get Started with Minder Close Menu Home Products Minder Trusty Company About Careers Open Source Press Resources Blog Videos Trusty Docs Minder Docs View all resources Contact Login Get Started For DevelopersVet the supply chain risk of open source packagesTrusty is a free-to-use web app that provides data and scoring on the supply chain risk for open source packages. Get Started with Trusty For Open Source CommunitiesSecure your software supply chainMinder is a supply chain security platform that helps you build more secure software and attest to your security practices. Get Started with Minder Stacklok On Twitter (X) Stacklok On Github Stacklok On LinkedIn Stacklok On Discord Stacklok On YouTube A new approach to software securityMalicious attacks are becoming more sophisticated, and AI is making it easier and faster for attackers to execute them. We need new ways to detect and prevent supply chain attacks. Stacklok is developing new tools and approaches, in alignment with open source communities. New from Stacklok: Minder Cloud Sign up now Video OverviewLearn more about our approach This video explains how Stacklok's products, Trusty and Minder, work together to help secure your software supply chain and proactively protect your software projects from malicious attacks. Minder CloudMinder Cloud helps open source developers and communities use open source security tools and standards to continuously secure their software projects, and provide proof of that security to their downstream consumers. Learn More Consistently configure source code reposNo more manual configuration and spreadsheets. Use Minder Cloud to apply and consistently enforce the same set of policies across a group of project repos. Find safer open source dependenciesMinder flags dependencies in pull requests that have known CVEs or high supply chain risk, and provides a list of safer alternatives to help developers find a different package to use. Secure GitHub Actions and CI/CD pipelinesImplement GitHub-recommended best practices like limiting workflow permissions and pinning actions to commit SHAs (Minder can even do this automatically for you!).  Daniel Finneran Isovalent "We had well over 100 repos at one point, and all needed some level of review. It would be ideal to be able to set a basic security standard for repos, automate as much as possible, and have remediation steps." Blog Announcing Minder Cloud: A fully managed software security platform for open source communities Continue Reading Make safer dependency choicesTrusty makes it easier for developers to understand whether an open source package is authentic, non-malicious, and actively maintained. It's free to use and accessible as a web app and as a Visual Studio Code extension. Learn More Activity scoringGet quick signal with our Trusty Score, which establishes a benchmark for average levels of activity based on statistical analysis of public GitHub package data. Package provenance When artifacts have been signed using Sigstore, Trusty displays a verifiable chain of trust back to the source code so that you know the package is what it says it is. Package recommendationsTrusty uses generative AI to provide a list of related packages and their scores, so that you can find and evaluate other packages if you need a safer option. Matt Klein Founder, Envoy proxy “Package activity is a key predictor of its health and safety. That's why Envoy's policy on external dependencies includes evaluation factors like number of commits in the last 90 days, release notes, and whether other projects depend on it, so that we can make safe choices." Blog Announcing the Proof-of-Diligence (PoD) algorithm: A method of modeling trust and maintainability in open source ecosystems Continue Reading Software Supply Chain Security (S3C) Weekly A free weekly newsletter about software supply chain security. We cover security incidents, security tips, free and OSS tools, and updates on community and public sector initiatives you should know about. Brought to you by Stacklok. Subscribe Now Latest News View All Securi-Taco Tuesday livestream recap: How code signing and Sigstore secure the software supply chain Stacey Potter / Sep 3, 2024 Community Supply Chain Security 101 Continue Reading Cross-platform RAT deployed by weaponized 'requests' clone Luke Hinds / Poppaea McDermott / Aug 30, 2024 Threat Analysis Continue Reading Now available in Trusty: Vulnerability and license information for open source packages Megan Bruce / Aug 27, 2024 Trusty Open Source Security Continue Reading NewsletterStay in the loopSubscribe to our newsletter for the latest news about our products and about open source supply chain security. © 2024 Stacklok Privacy Policy Terms of Service Main Menu Home About Careers Contact Products Trusty Minder Resources All Resources Blog Videos Trusty Docs Minder Docs Contact Us hello@stacklok.com Stacklok On Twitter (X) Stacklok On Github Stacklok On LinkedIn Stacklok On Discord Stacklok On YouTubeenen1727562604https://stacklok.com

Edit your site?

What are you doing?