Supply Chain Security

Home › Explanation › Continuous Delivery › Security › Supply Chain

Protecting against vulnerabilities in dependencies and container images.

---

Overview

Supply chain security focuses on managing risks from third-party code and container images that your application depends on.

Key Risks

Risk	Description
Known CVEs	Published vulnerabilities in dependencies
Outdated Dependencies	Old versions with known issues
License Compliance	Incompatible or problematic licenses
Supply Chain Attacks	Compromised or malicious packages

Defense Strategy

1. Scan dependencies - Identify known vulnerabilities
2. Generate SBOM - Track all components in your software
3. Check licenses - Ensure compliance with licensing requirements
4. Scan containers - Multi-layer image vulnerability analysis

---

Reference Documentation

For CLI commands and scanning configuration, see:

Supply Chain Security Reference - Complete implementation guide including:

• eac scan --scanner vuln/sbom/compliance commands
• Container scanning details
• Evidence output locations
• Stage-specific scanning guidance

---

Related Documentation

• SAST - Static Application Security Testing
• DAST - Dynamic Application Security Testing
• Shift-Left Security - Security integration principles
• Remediation - Handling security findings

---

Tutorials | How-to Guides | Explanation | Reference

You are here: Explanation — understanding-oriented discussion that clarifies concepts.