Dependency Security Management & Continuous Dependency Remediation

In the modern AppSec program, it's necessary to "shift-left" security & governance for dependency from the Code to the Plan stage.

Conceptual approach

Plan phrase:

For OSS Dependency:

• Benchmark OSS dependency project with OpenSFF Scorecard

For vendor and third-party dependency:

• Involve SBOM as artifacts release manifest in order to be aware of downstream dependencies. The benefits of the SBOM approach allow the security team to perform security assessments without the need for source code - might not available with third-party

Building private dependencies registry to secure store and sign-off for dependency to prevent availability and tampering issues from upstream maintainers

Code phrase:

• Setup proper dependency security scanning tool in CI/CD pipeline
• Setup Dependency Vulnerability Assessment to continuously scan and alerts for new finding developers

The issue is a conceptual proposal and names no repository files, entry points, or tests. Start by clarifying which goal is in scope: OpenSSF Scorecard benchmarking, SBOM release manifests, a private dependency registry, or CI/CD vulnerability scanning. Done should be defined as an agreed concrete deliverable with repository-specific implementation details.