'sbom' 검색 결과

Practical security review and hardening guidance for application code in Python, JavaScript/TypeScript, and Go. Use this skill whenever the user asks for a security review or audit, wants to harden authentication (password hashing, sessions, JWT, OAuth2/OIDC, MFA), fix OWASP Top 10 issues (injection, XSS, IDOR, CSRF, SSRF, deserialization), threat-model with STRIDE, clean up secrets and .env handling, or set up dependency scanning (pip-audit, npm audit, osv-scanner, gitleaks, SBOM). Also trigger for "make this secure", "is this safe to deploy", bcrypt/argon2id, rate limiting logins, RBAC/ABAC, CSP and security headers, cookie flags, and secure-by-default coding help.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings. Use when auditing a release for license compliance, vetting a new dependency's license, building an OSS-attribution document, or producing a customer-facing license disclosure.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Generate OpenVEX / CycloneDX VEX attestations from `.vulnetix/memory.yaml` triage decisions, optionally sign with cosign, optionally upload to Vulnetix and post to a GitHub PR. Use when documenting triage decisions for supply-chain consumers, attaching VEX to a CycloneDX SBOM, or satisfying customer attestation requests.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Concrete remediation proposal with Safe Harbour confidence — version bump, inline as first-party code, patch, workaround, or advisory. Use when applying a fix for a triaged CVE, evaluating fix-type trade-offs across registry / source / distro patches, producing rollback-safe manifest edits with dry-run verification, or generating a CycloneDX SBOM after the fix lands.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reconstructed reference notes on US FDA medical-device software regulation, built from seven public-domain FDA sources (the QMSR final rule 89 FR 7496, FDA device software guidance documents, and the eSTAR program page; pinned 2026-10-12). Use for regulatory pathways and premarket submissions (510(k), De Novo, PMA, eSTAR), premarket software documentation levels (Basic or Enhanced), software validation and Computer Software Assurance, the Quality Management System Regulation (QMSR, 21 CFR 820), medical-device cybersecurity (secure product development, SBOMs, FD&C Act section 524B, labelling), clinical decision support boundaries, off-the-shelf software, MDDS and other software-function scope questions, and the 510(k) software-change trigger. SCOPE LIMITS: US FDA device regulation only; no EU MDR or UKCA content (see `med-device-eu`); no ISO 13485, ISO 14971, or IEC 62304 text, which are named and summarized only as FDA obligations; no drug, biologic, or combination-product rules; reflects the pinned source dates, not later FDA actions; synthesized reference notes, not legal advice and not a substitute for the guidance documents. LICENCE: Public Domain (US Government work, 17 U.S.C. 105).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Knowledge base from NIST Secure Software Development Framework (SSDF) v1.1 (SP 800-218). Use for secure software development practices, SDLC security integration, software supply chain security, vulnerability disclosure, SBOM, threat modelling, secure coding, build hardening, EO 14028 compliance. Covers the four SSDF practice groups (PO, PS, PW, RV) only; does not cover NIST CSF, SP 800-53 controls, or cloud-specific security frameworks in depth.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dependency and license audit: production-level SBOM, lockfile, trust, copy restrictions. Use when implementing, reviewing or testing dependency and license audit for React, Vite, Next.js or Perfect_AI projects.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Docker (Docker Engine / Dockerfile / Compose / Buildx) の Dockerfile 命令, docker CLI, compose.yaml (Compose Specification), BuildKit, Bake (HCL), マルチステージ, マルチプラットフォーム, ビルドキャッシュ, SBOM / provenance, dockerd, daemon.json, logging driver, rootless, seccomp。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

GitHub 公式ドキュメント (docs.github.com)。REST API, GraphQL, Webhooks, GitHub Apps, OAuth Apps, gh CLI, PAT / GITHUB_TOKEN, Actions (jobs, steps, expressions, workflow commands, concurrency, OIDC, artifact attestations, lockfile), pull requests, issues, Projects v2, immutable releases, Codespaces, Packages, Copilot API / cloud agent, code scanning, secret scanning, Dependabot, Dependency graph / SBOM, Teams, Billing, activity (events / notifications)。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security review and threat work — threat modeling, vulnerability assessment, penetration test, incident response, OWASP Top 10, LLM Top 10, API Top 10, CVE triage, STRIDE, NIST CSF, SBOM. Auto-loops on any task touching PII, auth, payments or regulated data.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across multiple ecosystems to identify vulnerabilities, assess risks, and provide automated remediation strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.