devsecops-supply-chain-audit

To audit software supply chain risks, provide a repository path and the tool detects ecosystem manifests, spawning targeted sub-agents to assess dependency pinning, vulnerabilities, secrets, and SBOM generation across npm, pip, Go, Ruby, Cargo, Maven, Docker, and Terraform.

A supply chain audit report includes an overall trust score, SLSA self-assessment, and targeted remediation paths for identified vulnerabilities, secrets, image signing, branch protection, CODEOWNERS, and automation configurations.

Yes, you can assess branch protection and CODEOWNERS configuration, as the audit evaluates repository-wide governance signals including Dependabot or Renovate setup and provides actionable fixes to harden the supply chain.

Yes, the audit works without external scanners by operating in static mode to analyze manifests, but it can load available scanners and utilize live-mode data if they are installed on the system.

To generate an SBOM and check provenance, the tool automatically detects package managers like Cargo and Maven, then spawns per-ecosystem sub-agents to run targeted checks on dependency pinning and provenance signals.

The best way to harden repository governance and fix vulnerabilities is to run an audit that assesses npm and pip dependencies, evaluates branch protection, and provides targeted remediation paths for identified supply chain risks.