An application’s security is not limited to your own source code. Libraries, build servers, package registries and the deployment pipeline are part of the product too. SBOM lets you talk about what you use; SLSA, about trusting how that software was produced.
Which question does SBOM answer?
Knowing which packages, versions and components a product contains lets you find affected systems fast when a critical vulnerability appears. This list should not be created only on release day but kept current with every version.
Which question does SLSA strengthen?
Did the produced artifact really come from the source code we expected? Who or what intervened in the build process? Provenance information aims to make this chain more visible and verifiable.
A start for small teams
- Pin dependencies with a lockfile.
- Add package and container scanning to the CI pipeline.
- Separate build and deploy permissions.
- Store the published artifact and its commit link.
- Name a reviewer for critical package updates.
Security is not only scanning
If a vulnerability is invisible to a scanner, that does not mean there is no risk. Source identity, build environment, signing, access and rollback plans must be handled together.