Summary

In this chapter, we looked at how most modern software is a combination of third-party dependencies and bespoke code that leverages them. It detailed things to be ensured while using dependencies in code or running code that relies on dependencies, such as using the dependencies you intended and not similarly named ones, knowledge of all the dependencies (and sub-dependencies) both you and your suppliers are using, and regular dependency scans.

We also looked at different automated (SAST, DAST, Secrets scanning) and human-driven (ethical hacking) methods for robust testing, as well as mechanisms to invite and receive reports of bugs from external testers.

While in this chapter, we’ve ensured our ingredients are safe and properly sourced, our culinary journey is far from over. The next chapter will explore the final phase of your secure software journey—securing your software delivery.