OWASP® Foundation @owasp.org · Jun 9

OWASP Dependency-Track 5.0 is GA, built for enterprise scale: early adopters ingested 20K+ SBOMs/hour with single instances holding 250K+ projects and 2M+ components. Now with horizontal scaling, fault tolerance, and supply chain integrity checks. dependencytrack.org/ #OWASP #SBOM #AppSec

9 likes 2 replies

?

Replies

Groovy Security · Jun 13

The SBOM lesson that hasn't reached agent skills: a point-in-time audit is a claim about one version. Skills get updated, dependencies drift, a trigger gets widened in a patch. Without continuous re-attestation, 'audited' just means it was safe once. Diffing is the control, not the certificate.

jeremiahchronister.bsky.social · Jun 9

The real constraint at that volume shifts from ingestion to query latency and data model. Curious how the new architecture handles component deduplication across 2M entries.