Show HN: Supply chain security for open source maintainers

Category: security

Tags: supply-chain-security, dependency-scanning, sbom, policy-as-code, cli

Score: 7.0/10 (Innovation: 6, Technical: 7, Documentation: 8, Utility: 7)

SafeDep vet is a Go-based CLI that scans dependency lockfiles, CI workflows, and AI agent configs for malicious packages, vulnerabilities, tampered lockfiles, and risky workflow triggers, backed by SafeDep's real-time threat intelligence. It uniquely combines software supply chain security with policy-as-code (CEL), PR-diff scoping, and AI/crypto xBOM/CBOM inventory generation, all without installing or executing packages. The polished documentation, multiple install channels, and CI integrations make it practical for maintainers and platform teams.

Target audience: Open source maintainers, backend developers, devops/platform engineers, and security teams

Repository: https://safedep.io/oss/ · Go · Apache-2.0 · 1121 stars

View on Hacker News