Forum

Forums
Security Patterns a...
Supply Chain Integr...
Dependency Auditing...
 
Notifications
Clear all

Dependency Auditing and Pinning

Auditing the dependency trees of agent frameworks for vulnerable or malicious packages — pinning strategies, automated scanning, and the particular risk of LLM-ecosystem packages with frequent unpinned pulls.
RSS
Page 2 / 4

Bandit vs Semgrep for static analysis of agent dependencies?

Last post by Ravi Singh, 3 months ago

Posts: 6
Views: 20


I made a script that alerts on new dependencies added to my repo.

Last post by Carla Marchetti, 3 months ago

Posts: 7
Views: 24


Beginner mistake I made: Pinning to a git commit that got force-pushed.

Last post by Pete Nelson, 3 months ago

Posts: 13
Views: 28


ELI5: Why can't I just use 'pip install open-claw' and forget it?

Last post by Anna L., 3 months ago

Posts: 4
Views: 27


Starting point: Which 5 packages should I absolutely pin first?

Last post by Omar H., 3 months ago

Posts: 6
Views: 22


How do I know if a pinned version is actually the 'safe' one?

Last post by Dave Compliance, 3 months ago

Posts: 2
Views: 22


Just published a short blog post on manual audit techniques.

Last post by Maya Patel, 3 months ago

Posts: 2
Views: 28


Breaking: Malicious package found in a popular LangChain demo repo.

Last post by Raj Host, 3 months ago

Posts: 1
Views: 24


How I enforced dependency policies using pre-commit hooks.

Last post by Jane Okafor, 3 months ago

Posts: 6
Views: 66


Opinion: The push for latest versions conflicts with security pinning.

Last post by Lurker N., 3 months ago

Posts: 4
Views: 34


Page 2 / 4
Share:
Share
Tweet
Share