Skip to content

Commit e93bcfe

Browse files
authored
Update verification_workflow.md
1 parent 430860c commit e93bcfe

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

details/verification_workflow.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ In the evolving landscape of application development, reliance on third-party an
1414

1515
To create a secure and trusted source of Java libraries for your application, we have instituted a rigorous vetting process. This multi-tiered approach combines static code analyzers with human and AI-based code reviews. Upon successful security validation, libraries are incorporated into our secure repository. Each library is then packaged with a Software Bill of Materials (SBOM) and signed JAR files for additional assurance.
1616

17-
**Note**: Our focus is on vetting for security, and we don't modify the original code to fix known vulnerabilities. This ensures the integrity of the libraries, making our repository a robust line of defense against dependency confusion attacks.
17+
**Note**: We don't modify the original code during the library verification process. Any found vulnerabilities are remediated during the following [Library Vulnerability Remediation Workflow](details/vulnerability_remediation_workflow.md)
18+
1819

1920
The accompanying graph outlines the steps involved in our vetting process, providing a visual guide to how we ensure the safety and reliability of each library in our Trusted Artifactory.
2021

0 commit comments

Comments
 (0)