Understand the dependency and artifact risks around your application. Bring inventory, available scanner evidence and release decisions into a reviewable view.
@example/clientDirect dependency@example/parserTransitive dependencyA package list needs separate scanner evidence and a defined vulnerability scope.
Inventory ≠ evaluated. Unsupported or unevaluated scope remains visible; it cannot stand in for a clean result.
8f42c7a…sha256:42f1…9a20Check report integrity, origin and coverage against the intended project. A declared identifier alone does not establish binding. Identifiers shown here are abbreviated.
Supported, current scanner evidence for the intended scope.
The relevant revision and image digest must be bound to the evidence.
Evaluate the actual blockers. Binding alone does not make a release pass.
Missing, unsupported, stale or unbound?
Do not infer a passing scan.
Review the supported dependency and artifact information available for the project.
Inspect the scanner inputs, evaluated scope and relevant revision or digest when available.
Read the applied policy and blockers. Keep missing or unbound evidence distinct from a passing result.
A package list, a scanner report and a release decision answer different questions. Evaluate how TraceMint preserves those boundaries and connects them to the right source revision or artifact.
Generate and review the dependency inventory for the supported project inputs, including the manifest coverage and omissions behind it.
An SBOM or package inventory is not evidence that every dependency was evaluated for vulnerabilities.
Test the package managers and repository layout used by your delivery pipeline, including unsupported or partially parsed manifests.
Supported Trivy, Grype and npm audit artifacts retain their own import and coverage semantics. The report must be usable for the project it is attached to.
Uploading a report is not the same as configuring a live scanner connector or proving full upstream-tool compatibility.
Bring a genuine artifact from each scanner and edition you expect to use, rather than relying on a catalogue name.
Source evidence needs the relevant revision; container evidence needs the exact digest. A familiar tag or nearby checkout is not an equivalent identity.
A customer-supplied archive or manifest declaration is not automatically a verified Git checkout or deployment attestation.
Exercise both a matching revision/digest and a deliberately mismatched artifact in the evaluation.
The decision should name the applied policy, evaluated blockers and missing dimensions rather than reduce every state to red or green.
Policy export is not installation in a cluster, continuous reconciliation or a separate runtime-protection product.
Define one allowed release, one blocker and one incomplete-evidence case before connecting the decision to delivery.
An inventory alone does not prove dependencies were evaluated for vulnerabilities. The distinction is part of the review.
Understand which project, revision or artifact a report actually covers. A result from another checkout is not interchangeable.
Bring supported Trivy, Grype or npm audit artifacts and generate a CycloneDX dependency inventory through the supported tooling. Scanner results, inventory and container evidence each retain their own coverage limits.
Use configured CI and GitOps policies to evaluate blockers against the relevant revision and image digest. Missing, stale or unbound evidence must not be treated as a passing scan.
Inspect local configuration checks for the formats below alongside dependency and container evidence. These checks are distinct from AI source-language analysis and are not a cloud posture or running-cluster assessment.
Rule coverage and supported file layouts vary by format. Review the evaluated scope and findings in your project.
Coming soon: dedicated IaC scanningThis page describes application supply-chain security. It does not imply a separate cloud posture or runtime protection product.
Yes. Import supported Trivy, Grype or npm audit artifacts with their project, revision or digest identifiers. A report import is distinct from configuring a live connector or scheduled integration.
Applicable dimensions need evaluated evidence tied to the intended source revision or image digest, with no configured policy blocker. Inventory-only, stale, missing or unbound evidence remains incomplete or needs evidence.
Not by default. TraceMint combines supported scanner outputs, local inventory and configuration evidence in one review and policy trail. Existing scanners can remain the producers of dependency and image-vulnerability evidence.
Tell us what you want to evaluate. Our team will review your request and contact you to agree the scope and arrange a time.
Request a demo