Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
SBOM and VEX: Knowing What You Ship with CycloneDX 1.7 and SPDX 3
An SBOM is the machine-readable list of components in a release, and its real value is querying which version of which product is affected when a new CVE arrives, without building anything; VEX then states, with a justification, whether it is affected. For Bookstore we produce and verify .NET, Angular and image SBOMs, query them in Dependency-Track and apply OpenVEX and CycloneDX VEX with real output.
OWASP A03: Software Supply Chain Failures — NuGetAudit, npm audit and SRI
Why is A03:2025 Software Supply Chain Failures its own category? Lessons from event-stream, Log4Shell, xz, polyfill.io and the 2025 npm incidents; NuGetAudit scanning transitive dependencies on net10.0, warnings that break the build, lock files, npm audit and npm ci, SRI for CDN scripts, an SBOM with CycloneDX, provenance and Dependabot.