Skip to content

03 · Scan

Dependency-Track

Tracks known vulnerabilities in the dependencies listed in uploaded SBOMs

  1. Code
  2. Build
  3. Scan planned
  4. Store
  5. Deploy
  6. Observe

What it does

Dependency-Track ingests software bills of materials and continuously matches the libraries they list against known vulnerability data, flagging components that need an upgrade.

How it runs here

Deployed in the dependency-track namespace with separate API server and frontend components, served behind Traefik on dtrack.kei-space.com, with its REST API on a separate host, dtrack-api.kei-space.com. Sign-in goes through Keycloak over OpenID Connect, and projects and findings live in its own PostgreSQL database, with the API server's working data on a 10Gi Longhorn volume.

Connects to

Why I chose it

Stored SBOMs are re-matched as new CVEs are published, so a dependency that was clean when added gets flagged later without a rebuild.