RoseSecurity - Overview
RoseSecurity has 24 repositories available. Follow their code on GitHub.
SHA Pinning Is Not Enough
rosesecurity.devA few days ago I wrote about how the Trivy ecosystem got turned into a credential stealer. One of my takeaways was “pin by SHA.” Every supply chain security guide says it, I’ve said it, every subreddit says it, and the GitHub Actions hardening docs say it.