supply-chain-audit

Supply-chain integrity risks are identified by evaluating source, build, dependencies, and artifacts. The assessment generates an SLSA-aligned report with structured findings, evidence, and actionable remediation steps for hardening your posture.

An SLSA-aligned assessment systematically evaluates your build pipeline and artifacts against provenance standards. It identifies code-integrity risks and provides evidence-backed remediation guidance to harden your software supply-chain.

Generating an SBOM and provenance attestation requires committed lockfiles and evidence collection commands. The audit process assesses these components to verify code integrity and produce structured hardening recommendations.

Yes, committed lockfiles are a requirement for review. The supply-chain audit uses lockfiles alongside SBOM generation and provenance attestation to collect evidence and assess dependency integrity risks accurately.

Yes, after a dependency incident you can run a supply-chain audit on your repository or system. It generates a detailed posture assessment with evidence-backed findings and remediation steps to address the vulnerability.

The best way to remediate code-integrity findings is to follow the SLSA-aligned assessment's hardening recommendations. The audit provides clear evidence collection commands and targeted remediation steps for your CI pipeline and artifacts.