Joseph Hejderup

Conf42: DevSecOps 2022

Going Beyond Metadata: Why We Need to Think of Adopting Static Analysis in Dependency Tools

Software supply chain threats is on the rise. Existing dependency analyzers are looking to use static analysis to reduce false positives. I will hold a design discussion with practical examples on the promises & perils of moving towards adopting static analysis in package environments.