JFrog and GitHub unveil open source security integrations

Software security specialist JFrog and open source development community service GitHub are unveiling integrations that bring the capabilities of JFrog’s Software Supply Chain Platform to bear within GitHub’s code development platform.

The partners claim the tie-up will deliver a unified view of project status and security posture, hopefully enabling developers to address potential vulnerabilities earlier in the software development cycle, improving their efficiency, and reducing both cost and risk.

JFrog said the integration also extended its vision to integrate security into every stage of software development from planning to production.

“Developers often don’t realise there’s an issue until something breaks; it’s only then that they can start piecing together the puzzle to find out what went wrong,” said Yoav Landman, chief technology officer (CTO) and co-founder of JFrog.

“Our partnership with GitHub empowers teams to seamlessly navigate between code development and binary storage, enabling a more intuitive workflow.

“This integration is expected to enhance the developer experience and traceability, ensuring they can easily connect their source code with the corresponding binaries while maintaining a consolidated view of security so they can focus on delivering high-quality software without the worry of unseen vulnerabilities,” said Landman.

A recent JFrog report found that only 56% of organisations were using both source code and binary scanning to secure their software supply chain, leaving thousands of businesses open to attack at the most fundamental level – a very risky proposition as threat actors continue to prove highly adept at uncovering both bugs and flaws, and sensitive information stored in binaries.

The recent discovery by JFrog researchers of a token accidentally left in a Docket container that granted full access to the Python package repository aptly demonstrates this point – had it been exploited, tens of millions of systems all over the world, including many running core internet and cloud infrastructure, would have been impacted.