DependencyTrack / DependencyTrack/dependency-track
Add Dependency-Track as default project
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
When starting a fresh instance of Dependency-Track, there are no projects in the portfolio.
### Proposed Behavior:
Add Dependency-Track as default project to every new portfolio, with the SBOM that has been generated during the build (should be in the resources folder).
When a new critical CVE-vulnerability is reported, companies want to know whether any of the applications within their application landscape are affected by this vulnerability. Dependency-Track is part of this application landscape, so I think it should be part of the portfolio.
This project can also be used as an example project for users who want to quickly try out Dependency-Track without generating an SBOM themselves.
Maybe the project can be made read-only, but this would take more effort to implement. I’m also not sure whether the front-end and API server should be added as separate projects, or all components should be added to the same project.
Contributor guide
Assessment
This issue has not been assessed yet.