Enterprises rely extensively on open-source software in their application projects, but the time saved by using ready-made components comes at a cost. Incorporating outside code into the mix can potentially introduce new security vulnerabilities. 

Sonatype Inc., a software security startup backed by more than $70 million from investors such as Accel, is tackling the issue. Today it launched a free service called DepShield that can automatically identify vulnerable open-source components.

The offering is available as an embedded tool for GitHub, the industry’s go-to code hosting service and the home of most of the world’s open-source projects. DepShield draws on Sonatype’s OSS Index database of software security vulnerabilities to detect issues. The startup aggregates data from public threat intelligence sources such as the CVE system, which is funded by the U.S. Department of Homeland Security. 

When a developer incorporates a new open-source component into a project, DeepShield can automatically flag any issues that the project may contain. Sonatype said that notifications appear directly in the GitHub Issue Tracker to let users quickly pull up relevant details.

DepShield retrieves a description of each vulnerability from the public repository where it originated to save developers the hassle of opening a new tab. From there, they can view information such as how hackers could go about exploiting an issue. According to Sonatype, DepShield also displays what specific versions of an open-source project contain a given vulnerability to ease remediation.

The service is available for both public repositories and private ones housing companies’ internal projects. According to Sonatype, the service addresses a big need.

The startup recently conducted a study that found one in three companies had experienced suspected or verified breaches caused by open-source software vulnerabilities. This is the same challenge Sonatype addresses with its commercial Nexus platform, which is essentially an expanded version of DepShield with more advanced features.

“Developers live, eat, and breathe in GitHub. While developers find value in GitHub’s native dependency graph, they need, and are demanding, more self-help security,” Sonatype Chief Executive Officer Wayne Jackson said in a statement. “With DepShield, we’re enabling 28 million developers to add an initial layer of defense, to not only help protect their software projects, but the millions of enterprises, organizations and individuals who will use their code down the road.”

Photo: Unsplash