A developer has released Synapse, an open-source (Apache-2.0) Go control plane that runs the full security-assessment lifecycle behind a single gate and treats every result as re-checkable evidence ra…
A developer built ChainRisk Lens, an open-source tool that ingests CycloneDX SBOMs to construct deterministic dependency graphs, calculate downstream impact, and trace dependency paths for software su…
A developer building a slopsquatting detector removed three false-positive exceptions from its package-risk classifier after finding they cleared packages without real evidence. The rules treated npm …
A threat modeling assistant prompt guides users in generating a CycloneDX 2.0 TM-BOM JSON file that can be imported directly into Precogly, the OWASP threat modeling platform. The instructions cover b…
Jason-Doyle released version 1.0.0 of the AIBOM GitHub Action, a tool that generates an evidence-classified, deployment-aware AI Bill of Materials from a version-controlled manifest and repository dis…
A new operational handover guide advises teams taking ownership of AI-built apps to record every deployed dependency — data stores, external APIs, credentials, scheduled work, billing and delivery pip…
A new framework called the Agent Bill of Materials (AgBOM) is emerging to inventory autonomous coding agents in software pipelines, formalized through OWASP's Agent Observability Standard (AOS) projec…
UBEL, a free software composition analysis tool and install-blocking firewall, enforces security policies at install-time to block supply-chain attacks across dependencies, Linux packages, Docker, and…
Google Cloud open-sourced k8s-aibom, a Kubernetes controller that surfaces a bill of materials exposing AI operations in a user's cloud estate, to help auditors tackle shadow AI. The tool, deployed as…
Google Cloud open-sourced k8s-aibom, an unprivileged Kubernetes controller that automatically detects running AI runtimes and generates CycloneDX Machine Learning Bill of Materials (ML-BOMs) from live…
Vens Labs has released vens-action, a GitHub Action that reranks Trivy and Grype CVE scan results by actual business risk rather than generic CVSS scores. The tool reads scan output alongside a YAML c…