supply-chain-auditor

Auditing supply chain security involves detecting dependency managers and CI configurations to produce a prioritized risk report. This process inspects signals like package.json, Cargo.toml, and go.mod to evaluate workflow patterns and recommend concrete fixes.

Checking dependency pinning requires inspecting lockfiles like pnpm-lock.yaml, yarn.lock, and package-lock.json. The audit evaluates these signals to determine if dependencies are securely pinned and provides actionable remediation steps if they are not.

Reviewing GitHub Actions security involves inspecting workflow patterns and CI configurations for vulnerabilities. The audit detects relevant CI patterns, evaluates secure workflows, and generates a prioritized report with recommended mitigations to harden your pipelines.

Yes, the supply chain audit applies across common ecosystems including Python and Rust. It inspects signals like pyproject.toml, requirements.txt, and Cargo.toml to identify relevant ecosystems, skipping inapplicable checks silently to produce targeted risk assessments.

Hardening CI configurations and Docker image hygiene requires enforcing checks for secure workflows and image standards. The audit evaluates these patterns, identifies risks, and provides concrete fixes to enforce security standards across your repository.

Dependency detection inspects common signals across ecosystems, identifying relevant lockfiles like bun.lock, setup.py, and go.mod. It records which categories apply to your repository and skips inapplicable checks silently to generate an accurate risk report.