SBOM

Automating vulnerability monitoring for your own stack: match on the components you actually use

On sites that this site's operator runs, a PHP vulnerability, malicious code in a Python package and a container base image issue each reached a human before the automated watch, three times in one week. The rebuilt watch rests on three points: match on the names of components you actually use rather than technology words, let AI only raise urgency and never lower it, and keep working on days when the AI is unavailable.