My old teammate asked me why I still scan dependencies by hand, and I didn't have a good answer

Robin Henderson · 2026-10-02T00:10:03.647286+00:00

Sat down with a guy I used to do security reviews with at a coffee shop in Austin two weeks ago, and he pulled up his laptop to show me how his team handles third party library checks now. He asked why I was still running my scans one repo at a time like it was 2015, and honestly I just sat there because I never really thought about it. Turns out he had a full pipeline set up that flags bad packages before code even merges, and it caught 3 sketchy updates in their stack that same week. I've been doing it the slow way out of habit, not because it works better. What's everyone using to catch vulns in dependencies before they land in main?

SMM Buzz

Loading…

My old teammate asked me why I still scan dependencies by hand, and I didn't have a good answer | Appsec Tools - SMM Buzz