15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits • Git, System Design & Web Security (OWASP Top 10) • Rishabh Ki Kaksha

Git, System Design & Web Security (OWASP Top 10) › 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits

40 mins

← Prev Next →

Course Syllabus

Module 1: Git Internals, Plumbing Commands & DAG Graph Architecture

01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy) 02. Git DAG (Directed Acyclic Graph) & Plumbing Commands (cat-file, hash-object, write-tree) 03. Git Three Trees Architecture: Working Directory, Staging Index & HEAD

Part 1: Git Mastery, Security Defense & Caching

Module 2: Advanced Branching Strategies & Disaster Recovery

04. Advanced Rebasing: Interactive Rebase (squash, edit, fixup) vs Merge 05. Git Disaster Recovery: git reflog, Cherry-Pick & Recovering Deleted Commits/Branches 06. Enterprise Branching: Trunk-Based Development vs GitFlow vs Feature Flag Architecture

Module 3: Web Application Security: OWASP Top 10 Defenses

07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP) 09. CSRF vs Cross-Origin Traps: SameSite Cookies, Anti-CSRF Tokens & CORS Preflight Rules 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

Module 4: Cryptography, PKI, SSL/TLS & Mutual Auth (mTLS)

11. Asymmetric Cryptography (RSA vs ECC) & Digital Signatures with GPG Keys 12. Public Key Infrastructure (PKI), TLS 1.3 Handshake & Let's Encrypt Automation 13. Mutual TLS (mTLS) for Zero-Trust Service-to-Service Communication

Module 5: DevSecOps, Secret Scanning & Zero-Trust Security Architecture

14. Automated Secret Scanning (Gitleaks, Trufflehog) & Git Pre-Commit Hooks 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits 16. Enterprise Zero-Trust Architecture: Cloud IAM, Bastion Hosts & WireGuard VPN Networks

Interactive Lesson Studio

# 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits

> Git & Web Security Notes by Rishabh - Topic 15

---

### 1. Software Supply Chain Attacks (SolarWinds & event-stream ☣️)

Hacker aapke code ko hack nahi karta — aapke dwara use kiye gaye open-source npm/pip package (`node_modules`) me malicious code inject kar deta hai!

---

### 2. SBOM (Software Bill of Materials) & Syft / CycloneDX 📜

SBOM aapke software application ka complete nutrition ingredients label hota hai:

```bash
# Generate CycloneDX SBOM JSON for production image:
syft rishabh-kaksha-api:latest -o cyclonedx-json=sbom.json

# Scan SBOM for known CVE vulnerabilities with Grype:
grype sbom:sbom.json
```

---

### 3. Automated Dependency Audits & Lockfile Integrity

*   `npm ci`: Lockfile (`package-lock.json`) ke exact SHA-512 hashes verify karke clean install karta hai.
*   `npm audit --production`: Known CVE databases se matching vulnerabilities detect karta hai.

---

### 4. Master Comparison Matrix

---

### 5. Interview Ke 3 Sawal Is Topic Se

1. **`npm install` aur `npm ci` me supply chain security perspective se kya difference hai?** -> `npm install` `package.json` versions ko auto-update kar sakta hai; `npm ci` strictly `package-lock.json` integrity hash enforce karta hai bina dependencies mutate kiye.
2. **Dependency Confusion Attack kya hota hai?** -> Attacker public npm registry par company ke internal private package name se malicious package publish kar deta hai; build system public registry se pull kar leta hai.
3. **Sigstore Cosign container image signing kaise karti hai?** -> OpenID Connect (OIDC) identity use karke container image digest ko cryptographically sign karti hai taaki Kubernetes cluster sirf trusted signed images run kare.

---
**Next Topic:** 16. Enterprise Zero-Trust Architecture: Cloud IAM, Bastion Hosts & WireGuard VPN Networks

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track