ReliQuery.io的动态

查看ReliQuery.io的组织主页

39 位关注者

There are three things that are required to achieve supply chain security in a Python development environment. 1. Visibility into the packages that your software is using. 2. Vulnerability analysis on the packages you are using. 3. The ability to deny access to an open-source package or a specific release of that package if It fails your vulnerability risk assessment. You cannot achieve any of these three by simply using PyPI directly. But you can by using ReliQuery.io! 1. ReliQuery.io will notify you about every package and version that is downloaded or uploaded to your Private Python ReliQuery, including the user that did so. This allows you to maintain a comprehensive record of every package used by your organization and the frequency of the use. It also allows you to perform analysis of your own on new packages to your team. 2. ReliQuery.io will perform Bandit vulnerability analysis on every package that you upload, and will include the report in the upload notification. This allows you to maintain a comprehensive record of vulnerabilities introduced by your team and allows you to intercept and rectify them near the point of creation. 3. When you receive notification that a new package/version has been downloaded, you can access that package/version directly using the API, execute your own vulnerability analysis on it, and if that analysis fails you can deny access to that package/version using the API. ReliQuery.io gives you the tools to ensure the sanctity and security of your software supply chain. Give us a try today!

Simple Private Software Distribution

Simple Private Software Distribution

reliquery.io

要查看或添加评论,请登录