Get the dependency and supply-chain risk under control
Continues from the last build: SAST gates new findings in CI with tuned, actionable rules.
Semgrep is quiet now, it only flags real, actionable findings in the code you and your team actually wrote.
What you'll build
By the end, the pipeline knows exactly what third-party code ships inside the app, an SBOM proves it, Dependabot keeps dependencies moving without a human remembering to check, and a Trivy gate blocks any build that introduces a fixable HIGH or CRITICAL vulnerability, with a single reviewed, expiring file documenting the handful of exceptions you cannot fix yet.
See how we teach, before you sign up
You don't just get code dumped on you. Every starter file and every solution is explained line-by-line, in plain English. Here's one real file from this project:
{
"name": "ledgerline",
"private": true,
"dependencies": {
"axios": "0.21.1",
"express": "^4.18.2",
"jsonwebtoken": "^9.0.2",
"pg": "^8.11.3"
},
"devDependencies": {
"typescript": "^5.4.0"
}
}
Reading this file
"axios": "0.21.1"this exact version is affected by a credential-leakage CVE fixed in a later 1.x release, this is what trivy fs will flag first"express": "^4.18.2"express pulls in body-parser, which pulls in qs, the transitive dependency you will need an override for later"private": trueprevents an accidental npm publish, unrelated to the CVE work but good hygiene worth noticing in any package.json you touch
Starting state: axios is pinned to a known-vulnerable version, and there is no overrides block for the transitive qs dependency express/body-parser pull in behind the scenes.
That's 1 of 7 explained code blocks in this single project.
The build, milestone by milestone
- 1
Scan dependencies with Trivy and read the CVE like an engineer, not a scanner
5 guided stepsMost engineers either ignore SCA findings entirely or panic-upgrade everything the moment a scanner prints red text. Neither is an engineering response. The job is triage: which findings are real, reachable risk, and which are noise, before you spend a single minute remediating.
- 2
Remediate deliberately: direct upgrade, breaking change, and the transitive dependency you cannot touch directly
6 guided stepsBlindly running npm audit fix --force has broken more apps than it has fixed, it will happily downgrade or upgrade across major versions without telling you what changed. A deliberate upgrade means you read the release notes, you understand what moved, and you can explain the fix in one sentence in a PR description.
- 3
Generate an SBOM with Syft so what is in it stops being a guess
4 guided stepsWhen the next zero-day drops in some library you have never heard of, the fast path to an answer is grep-ing a stored SBOM for the package name and version, not re-cloning old commits and re-running npm ls. Security teams get asked "are we affected" on a timescale of hours, not days.
- 4
Automate the treadmill: Dependabot for versioned and security updates
5 guided stepsManual scanning catches what you already have; Dependabot catches what changes after you stop looking. A CVE disclosed against a package you depend on next month needs a PR to appear on its own, you should not be the trigger for that process.
- 5
Gate the pipeline: fail the build on fixable HIGH/CRITICAL, with a justified and expiring exception list
5 guided stepsA scanner that only reports is advisory, a scanner wired into the merge gate is enforcement. But an exception list with no justification and no expiry quietly turns into a graveyard of forgotten CVEs nobody ever revisits, which is exactly the blind spot this rung exists to close.
What's inside when you start
You'll walk away with
This is portfolio-grade. Build it free.
Sign up to unlock every milestone step-by-step, the code skeletons, full reference solutions, and checkable tasks, with your progress saved as you build.
Start building