S

SBOM

A curated kaniko for GitLab Runner. Signed and attested container builds: six image variants per release on UBI9, standard and FIPS 140-3, with CycloneDX SBOM and SLSA provenance.

DevSecOps health check for GitLab Self-Managed instances.

Chapter 4: a Go binary at report phase. Gaps are published and advisory, so the merge request stays green while the finding rides along.

Analyzer that scans for application dependencies.

[Reference tool] Analyze SBOM dependency graph complexity to predict BuildDependencyGraphWorker performance. CycloneDX and SPDX 2.3. No compiled artifact.

Security-hardened reusable GitHub Actions workflows for Go, Python and Docker CI/CD: lint, test, scan, build, publish, release. Plus ClawHub skill/plugin publishing, MCP registry publish, self-rendered SVG badges, Codeberg/GitLab/Gitee mirroring, and a PR gate for non-collaborators. One uses: line, no copy-paste.

BETA: Dependency Scanning for supported projects

Container Foundry is a project for building, scanning, publishing, signing, and attesting custom OCI container images.

A package for installation into .Net projects, for reporting data to a Metaport server.

A package for installation into PHP web-projects, for reporting data to a Metaport server.

A package for installation into Python web-projects, for reporting data to a Metaport server.

A package for installation into NodeJS web-projects, for reporting data to a Metaport server.

A fast, minimal viewer for SPDX SBOMs: cascading documents, compliance profiles (NTIA, BSI TR-03183), VEX overlay. Client-side, files never leave your machine.

Gitlab CI/CD template that facilitates scan targets against security issues

CI/CD component to extract SBOMs from GitLab projects.

VEX exporter for GitLab projects using Dependency Scanning

Harness Software Supply Chain CI/CD components for GitLab. SBOM, SLSA, Artifact Signing, and Policy Enforcement

A fast, minimal viewer for Open Component Model deliveries: CTF archives, embedded SBOMs, client-side signature verification, OCI registry browsing.

D3FENDer is a security assessment and gap detection tool developed by Michael Favvas for his thesis titled "Development of a security assessment and gap detection system using the MITRE ATT&CK and D3FEND Frameworks". It uses a rule based system to grade an organization's defenses based on the input. It then detects possible gaps and suggests mitigations based on the MITRE ATT&CK and D3FEND Knowledge Bases. The tool can be used in SOC work flows.

Integrate SCANOSS Platform with Gitlab