From c4e2db4755ecc833665cb58c330ceb26ce32d27c Mon Sep 17 00:00:00 2001 From: cproudlock Date: Sat, 29 Aug 2026 17:20:57 -0400 Subject: [PATCH] Route the dependency-security doc from START-HERE START-HERE routes by the question somebody arrived with, and 'are we exposed to this CVE' had no entry - the SBOM was only mentioned in the Windows update doc, which is not where anybody asking that would look. --- docs/START-HERE.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/START-HERE.md b/docs/START-HERE.md index d98476bc..4f4bac75 100644 --- a/docs/START-HERE.md +++ b/docs/START-HERE.md @@ -64,6 +64,16 @@ message or a sticky note. Read the "Before anybody relies on it" section first: there is one thing to test at your site before the first real credential goes through it. +## Somebody is asking whether we are exposed to a published vulnerability + +[DEPENDENCY-SECURITY](DEPENDENCY-SECURITY.md). Every release installs +`sbom.cdx.json`, a full inventory of third-party components and versions, so a +security team can answer this on their own without access to anything here. + +In the repository, `scripts/scan_sbom.py` checks that inventory against +published advisories and separates what ships from what only builds - the two +are not the same finding, and only the first can fail a release. + ## I am trying to understand why something is built this way [The ADRs](adr/ADR-001-asset-as-platform-contract.md). They are the decision record,