Supply Chain Security Audit
Assessing software supply chain risk by analyzing dependencies, container images, infrastructure-as-code, and build pipelines for vulnerabilities, embedded secrets, and policy violations. Covers SBOM generation, dependency confusion testing, and CI/CD pipeline hardening validation.
Dependency Inventory and SBOM Generation
Generate a complete software bill of materials for every artifact in scope - application source code, container images, and deployed binaries. Identify every direct and transitive dependency, its version, license, and source. You cannot secure what you haven't inventoried, and most organizations dramatically underestimate their transitive dependency count.
Tools for this step
Syft
Trivy
OSV-ScannerTip: Syft generates SBOMs in SPDX and CycloneDX formats from source, containers, and filesystems. Run it against both the source repo and the built container image - they often differ because build steps pull additional dependencies. Feed the SBOM into OSV-Scanner for vulnerability matching against the OSV database, which aggregates CVEs from multiple ecosystems.
Dependency Vulnerability Scanning
Scan all identified dependencies against vulnerability databases to find known CVEs. Prioritize by exploitability and reachability - a critical CVE in a dependency that your code never actually calls is lower priority than a medium-severity issue in a function you invoke directly. Check for dependencies that are unmaintained, archived, or have suspicious recent maintainer changes.
Tools for this step
Retire.jsTip: Grype provides fast vulnerability matching with detailed CVE information and fix versions. Use retire.js specifically for JavaScript/Node projects where transitive dependency chains get absurdly deep. Check whether vulnerable functions are actually reachable from your code before raising critical alerts - many CVEs affect functionality that the application never touches.
Secrets Detection Across the Codebase
Scan the entire repository history, not just the current HEAD, for accidentally committed secrets. Developers routinely commit API keys, database passwords, private keys, and tokens, then try to remove them in a later commit. The secret remains in git history permanently unless the repo is rewritten. Check configuration files, environment templates, and CI/CD pipeline definitions too.
Tools for this step
Gitleaks
TruffleHogTip: Gitleaks scans the full git history by default and uses regex plus entropy detection. TruffleHog goes further by actually verifying found credentials against live services to confirm they're active. Run both - they use different detection approaches and catch different things. Pay special attention to .env.example files, docker-compose files, and CI config that often contain real credentials disguised as examples.
Container Image Security Analysis
Audit container images for vulnerable base images, unnecessary packages that expand the attack surface, files running as root, missing health checks, and configuration issues that weaken runtime security. Check whether images are pinned to digests or floating tags, whether multi-stage builds are used to minimize the final image, and whether distroless or minimal base images are an option.
DockleTip: Dockle specifically audits Dockerfiles and images against CIS Docker Benchmark best practices - it catches issues like missing USER directives, ADD instead of COPY, and latest tags. Trivy scans the image filesystem for OS and application vulnerabilities simultaneously. Check if the image contains build tools, package managers, or shells that shouldn't be present in production images.
Infrastructure-as-Code Review
Scan Terraform, CloudFormation, Kubernetes manifests, Helm charts, and other IaC definitions for security misconfigurations before they reach production. Check for overly permissive IAM policies, unencrypted storage, public network exposure, missing logging, and hardcoded secrets in templates. IaC review is cheaper than fixing misconfigurations after deployment.
Checkov
KICS
SemgrepTip: Checkov covers Terraform, CloudFormation, Kubernetes, Helm, and Dockerfile with 1000+ built-in policies. KICS (Keeping Infrastructure as Code Secure) provides additional coverage for Ansible, Docker Compose, and Pulumi. Semgrep with its supply-chain rules catches patterns like dependency confusion risks and unsafe package installation. Run all three - overlap is minimal and each catches unique issues.
Static Application Security Testing
Run SAST tools against the application source code to catch insecure coding patterns, injection vulnerabilities, authentication flaws, and unsafe deserialization. Focus on custom code that glues dependencies together - this is where supply chain risk meets application risk. A vulnerable dependency is only exploitable if the application passes attacker-controlled input to the vulnerable function.
Bandit
BearerTip: Semgrep with community rulesets covers most languages and catches injection, auth, and crypto issues with low false positive rates. Bandit is Python-specific and catches issues like subprocess shell=True and hardcoded passwords. Bearer focuses on data flow and sensitive data exposure. Write custom Semgrep rules for your organization's specific anti-patterns - generic rules miss domain-specific issues.
Report and Remediation Priority Matrix
Compile all findings into a prioritized remediation plan. Group by severity and effort-to-fix. A critical vulnerability in a transitive dependency with no available fix requires a different response than one with a simple version bump. Include specific fix commands (npm audit fix, pip install --upgrade, docker pull with pinned digest) and flag any findings that require architectural changes versus simple updates.
Tip: Prioritize by actual exploitability, not just CVSS score. A critical CVE with no public exploit in a dependency you don't directly invoke is lower priority than a high-severity issue with a Metasploit module in code you call on every request. Include a dependency update policy recommendation - automated PRs for patch versions, manual review for minor/major. Flag any dependencies with recent maintainer transfers or suspicious activity.
Other Workflows
OSINT Investigation Workflow
A structured approach to open-source intelligence gathering, from target identification through to reporting. Covers passive reconnaissance, social media analysis, email and phone lookups, and data correlation.
Web Application Penetration Test
A systematic approach to testing web applications for security vulnerabilities. Covers reconnaissance, mapping, vulnerability discovery, exploitation, and reporting.
Active Directory Attack Path
From initial foothold to domain admin. A step-by-step approach to enumerating and attacking Active Directory environments during authorized penetration tests.