# Software Supply Chain Topics Browse by category or alphabetically, and access in-depth articles on key software supply chain topics—from languages and libraries to package managers, toolchains, and security practices. ###### Access Control Access control defines and enforces who can access or modify digital resources to protect data and ensure compliance. [Learn More](/content/learn/devsecops/access-control/index.html) ###### Agent Skills Repository An agent skills repository is a centralized, versioned store for artificial intelligence agent capabilities that functions as a strictly... [Learn More](/content/learn/ai-security/agent-skills-repository/index.html) ###### Agentic Repository An agentic repository is a new type of software repository that uses AI agents to automate and optimize the software delivery process. [Learn More](/content/learn/devops/agentic-repository/index.html) ###### Agentic Supply Chain An agentic supply chain is an autonomous system where AI agents reason and execute tasks to resolve disruptions and secure software... [Learn More](/content/learn/ai-security/agentic-supply-chain/index.html) ###### AI Agent Immunization AI agent immunization is a multi-layered defense mechanism that embeds protection into an autonomous... [Learn More](/content/learn/ai-security/ai-agent-immunization/index.html) ###### AI Gateway An artificial intelligence (AI) gateway is a centralized proxy layer that manages traffic between applications and model providers to... [Learn More](/content/learn/ai-security/ai-gateway/index.html) ###### AI Governance AI governance is a set of guidelines and procedures to manage AI from development to deployment to ensure it is compliant and safe for... [Learn More](/content/learn/ai-security/ai-governance/index.html) ###### AI Regulatory Compliance AI regulatory compliance is the process of ensuring AI systems meet applicable legal standards... [Learn More](/content/learn/grc/ai-regulatory-compliance/index.html) ###### AI Security AI security is the practice of protecting machine learning systems, data, and pipelines from... [Learn More](/content/learn/ai-security/ai-security/index.html) ###### AI TRiSM AI TRiSM is a framework for governing artificial intelligence models that ensures systems remain... [Learn More](/content/learn/ai-security/ai-trism/index.html) ###### AIBOM AnAIBOM is a standardized record of artificial intelligence... [Learn More](/content/learn/ai-security/aibom/index.html) ###### API Security API security mitigates attackers' abuse of an Application Programming Interface to disrupt systems or steal data. [Learn More](/content/learn/devsecops/api-security/index.html) ###### Application Security Application security refers to the measures taken to protect software applications from threats and vulnerabilities. [Learn More](/content/learn/devsecops/application-security/index.html) ###### Artifact Management Artifact Management is the process of organizing and storing software binaries and their metadata to... [Learn More](/content/learn/devops/artifact-management/index.html) ###### AST Application Security Testing (AST) identifies, reports, and detects vulnerabilities in software applications throughout the SDLC. [Learn More](/content/learn/devsecops/application-security-testing/index.html) ###### Backdoor Attack A backdoor attack is a technique used by threat actors to create a hidden entry point into an application or environment. [Learn More](/content/learn/devsecops/backdoor-attack/index.html) ###### Binary Repository Manager A tool that allows you to organize your compiled binaries into repositories, just as you organize your source code into repositories. [Learn More](/content/learn/binary-repository-manager/index.html) ###### Build As a verb, to compile your source code into an executable binary. As a noun, a version of your application as an executable binary. [Learn More](/content/learn/build/index.html) ###### CI/CD CI/CD streamlines and automates the process of integrating, testing, and delivering code changes to applications. [Learn More](/content/learn/devops/ci-cd/index.html) ###### CI/CD for Machine Learning CI/CD for machine learning is an automated workflow that integrates and deploys model code and artifacts, enabling rapid, reliable... [Learn More](/content/learn/mlops/cicd-for-machine-learning/index.html) ###### Cloud Native Cloud native is an approach to building and running software specifically designed to leverage the flexibility, scalability, and... [Learn More](/content/learn/cloud-native/index.html) ###### Cloud Native Development Acceleration Learn the 7 essential practices that a DevOps solution must enable to accelerate your path to cloud native development. [Learn More](/content/learn/cloud-native/7-ways-to-accelerate-cloud-native-development/index.html) ###### CNAPP A cloud-native application protection platform (CNAPP) is a consolidated security solution that unifies cloud posture and workload... [Learn More](/content/learn/cloud-native/cnapp/index.html) ###### Code Signing Code signing is a cryptographic process that uses a digital signature to confirm a software artifact’s origin and integrity. [Learn More](/content/learn/devsecops/code-signing/index.html) ###### Compiler A compiler translates an application written in a higher-level programming language into a lower-level language so it can be executed. [Learn More](/content/learn/sdlc/compiler/index.html) ###### Container A virtualized operating system environment that includes an application and its dependencies, helping it run anywhere it's deployed. [Learn More](/content/learn/container/index.html) ###### Container Orchestration Container Orchestration is an automated process that manages the lifecycle of containerized applications across a cluster of servers,... [Learn More](/content/learn/cloud-native/container-orchestration/index.html) ###### Container Registry A container registry is a centralized repository service for storing, managing, and distributing container images, enabling consistent... [Learn More](/content/learn/cloud-native/container-registry/index.html) ###### Container Runtime Security Container runtime security is a component of application security, helping to detect/mitigate issues that impact running containers. [Learn More](/content/learn/devsecops/container-runtime-security/index.html) ###### Container Security Container security is the practice of protecting containerized applications across the build, ship, and... [Learn More](/content/learn/devsecops/container-security/index.html) ###### Containerization Containerization is an operating system virtualization method that packages code and its dependencies into isolated units to ensure... [Learn More](/content/learn/cloud-native/containerization/index.html) ###### Continuous Delivery Continuous delivery (CD) is a software development practice that ensures code changes are always in a deployable state. [Learn More](/content/learn/devops/continuous-delivery/index.html) ###### Continuous Deployment Like Continuous Delivery, a philosophy that your software updates should be continuously delivered to the target. However, Continuous... [Learn More](/content/learn/continuous-deployment/index.html) ###### Continuous Integration Continuous integration (CI) is a software development practice where developers merge code changes into... [Learn More](/content/learn/devops/continuous-integration/index.html) ###### Contract Testing Contract testing is a software testing methodology that evaluates interactions between individual software services to ensure they... [Learn More](/content/learn/devsecops/contract-testing/index.html) ###### CSPM Cloud environments typically include a large number of diverse workloads running across multiple cloud services, with thousands of human... [Learn More](/content/learn/devsecops/cloud-security-posture-management/index.html) ###### CVE CVE is a list of publicly disclosed cybersecurity vulnerabilities that provides a standardized identifier to help organizations track... [Learn More](/content/learn/devsecops/cve/index.html) ###### CVSS The Common Vulnerability Scoring System (CVSS) is a standardized framework for rating the severity of security vulnerabilities. [Learn More](/content/learn/devsecops/cvss/index.html) ###### Cybersecurity Maturity Model Certification (CMMC) CMMC is a mandatory Department of Defense framework setting verifiable security standards for defense... [Learn More](/content/learn/grc/cmmc/index.html) ###### DAST Dynamic Application Security Testing is designed to test applications in real-time under operating conditions. [Learn More](/content/learn/devsecops/dynamic-application-security-testing/index.html) ###### Data-Centric AI Data-centric AI systematically engineers training data quality, labeling, and consistency while holding model architecture fixed to... [Learn More](/content/learn/mlops/data-centric-ai/index.html) ###### Dependency Code, libraries, or tools that your application relies on to operate. May or may not be written by a third party. [Learn More](/content/learn/dependency/index.html) ###### DevGovOps DevGovOps is a framework integrating governance and compliance into the DevOps lifecycle to ensure that software delivery remains both... [Learn More](/content/learn/grc/devgovops/index.html) ###### DevOps DevOps unites software development and IT operations teams.Learn More ###### DevOps vs DevSecOps DevOps optimizes how you ship through Dev and Ops collaboration, while DevSecOps integrates security into every stage of the lifecycle... [Learn More](/content/learn/devops-vs-devsecops/index.html) ###### DevSecOps DevSecOps is the integration of security processes within the software development lifecycle to identify... [Learn More](/content/learn/devsecops/devsecops/index.html) ###### DevSecOps Tools DevSecOps tools are automated applications that embed security testing into the development lifecycle to... [Learn More](/content/learn/devsecops/devsecops-tools/index.html) ###### Docker Docker is an open-source platform that uses containerization to package applications, ensuring software runs consistently across... [Learn More](/content/learn/cloud-native/what-is-docker/index.html) ###### Docker Alternatives Docker alternatives are containerization tools and platforms that provide functionalities similar to Docker to create, manage, and run... [Learn More](/content/learn/devops/alternatives-to-docker/index.html) ###### Docker Hub Docker Hub is a cloud-based registry service that allows developers to store, share, and distribute container images to simplify... [Learn More](/content/learn/cloud-native/what-is-docker-hub/index.html) ###### Exposure Management Exposure management is a continuous practice for finding and fixing exploitable risk. [Learn More](/content/learn/devsecops/exposure-management/index.html) ###### Fine Tuning LLMs Fine-tuning LLMs on narrowly focused datasets enables them to acquire deep domain expertise, significantly improving their accuracy and... [Learn More](/content/learn/mlops/fine-tuning-llms-on-custom-datasets/index.html) ###### GitOps GitOps is an operational framework that manages infrastructure configurations in Git, providing a single... [Learn More](/content/learn/cloud-native/gitops/index.html) ###### GRC GRC is a unified strategy integrating governance, risk, and compliance into software operations to protect the organization and fulfill... [Learn More](/content/learn/grc/grc/index.html) ###### Hashing Hashing is the process of converting input data into a fixed-length string using a mathematical algorithm to verify data integrity and... [Learn More](/content/learn/sdlc/hashing/index.html) ###### Helm Helm is a Kubernetes package manager that bundles application resources into versioned packages called charts to enable consistent... [Learn More](/content/learn/cloud-native/helm/index.html) ###### How to Build Docker Images A Docker image is a read-only template that packages an application with its dependencies and runtime configuration. [Learn More](/content/learn/cloud-native/how-to-build-docker-images/index.html) ###### HTTP proxy An HTTP proxy is a server that sits between web servers and clients to intercept, analyze, and forward network requests to boost... [Learn More](/content/learn/devsecops/http-proxy/index.html) ###### Identity and Access Management (IAM) Identity and access management (IAM) is a security framework for controlling user and device privileges to prevent unauthorized access... [Learn More](/content/learn/devsecops/iam-identity-access-management/index.html) ###### Indirect Prompt Injection Indirect prompt injection is a type of security vulnerability where an AI model acts maliciously as a result of malicious instructions... [Learn More](/content/learn/ai-security/indirect-prompt-injection/index.html) ###### Infrastructure as Code (IaC) Infrastructure as code (IaC) is an IT management practice that provisions and manages cloud infrastructure using machine-readable... [Learn More](/content/learn/devsecops/iac-infrastructure-as-code/index.html) ###### Insider Threats An insider threat is a security risk originating from individuals within an organization who misuse authorized access, resulting in data... [Learn More](/content/learn/devsecops/insider-threat/index.html) ###### Integration Tests A type of testing that verifies entire parts of an application work when combined with other parts of an application. [Learn More](/content/learn/sdlc/integration-tests/index.html) ###### Interpreter A tool that translates source code in a higher-level language into a lower-level language for execution, line-by-line, at runtime.... [Learn More](/content/learn/interpreter/index.html) ###### IoT The Internet of Things (IoT) is a network of connected devices that collect and... [Learn More](/content/learn/cloud-native/iot/index.html) ###### ISO 27001 SO 27001 is an international standard that provides a risk-based framework for establishing and... [Learn More](/content/learn/grc/iso-27001/index.html) ###### Kubernetes Registry A Kubernetes registry is a storage system for container images used by Kubernetes clusters to deploy application workloads reliably. [Learn More](/content/learn/devsecops/kubernetes-registry/index.html) ###### Large Language Model Operations (LLMOps) LLMOps is a framework for managing large language model lifecycles to ensure reliable production deployment, performance, and... [Learn More](/content/learn/mlops/llmops/index.html) ###### License A legal document that defines how a piece of software may be used, and what the implications are for using it. Licenses may define rules... [Learn More](/content/learn/devsecops/license/index.html) ###### Malware Insertion A software supply chain attack occurs when malicious actors insert malware or tampered code into the software development or delivery... [Learn More](/content/learn/devsecops/malware-software-supply-chain/index.html) ###### Masquerading Masquerading is a deceptive technique where a malicious actor or artifact impersonates a trusted entity to bypass security controls and... [Learn More](/content/learn/devsecops/masquerading/index.html) ###### MCP Registry An MCP registry is a centralized service for discovering, versioning, and governing Model Context Protocol (MCP) servers and tools... [Learn More](/content/learn/ai-security/mcp-registry/index.html) ###### Microservice A software development architecture that breaks your application up into multiple independent services that interact with one another.... [Learn More](/content/learn/microservice/index.html) ###### Microservices Security Microservices security is the framework of practices and controls used to safeguard distributed application services, inter-service... [Learn More](/content/learn/devsecops/microservices-security/index.html) ###### ML Experiment Tracking Tool An ML Experiment Tracking Tool is a specialized platform designed to log, organize, and analyze... [Learn More](/content/learn/mlops/experiment-tracking-tool/index.html) ###### ML Model Interpretability Machine learning model interpretability is the degree to which a human can understand how a model reaches its predictions, ensuring... [Learn More](/content/learn/mlops/ml-model-interpretability/index.html) ###### ML Pipeline An end-to-end machine learning pipeline automates data ingestion, preprocessing, training, deployment, and monitoring to deliver... [Learn More](/content/learn/mlops/ml-pipeline/index.html) ###### MLOps MLOps is a set of practices that automates the machine learning lifecycle to bridge the gap between data science and operations and... [Learn More](/content/learn/mlops/mlops/index.html) ###### Model Context Protocol The Model Context Protocol (MCP) is an open, universal standard for connecting AI models to organizational data sources and tools,... [Learn More](/content/learn/devops/mcp/index.html) ###### Model Deployment Model deployment is the step within the machine learning life cycle where a new model moves into a... [Learn More](/content/learn/devops/model-deployment/index.html) ###### Model Registry A model registry in MLOps (Machine Learning Operations) is a centralized repository that manages the lifecycle of machine learning... [Learn More](/content/learn/mlops/model-registry/index.html) ###### ModelOps ModelOps is a holistic framework of practices and tools for operationalizing and governing machine learning models across an enterprise... [Learn More](/content/learn/mlops/modelops/index.html) ###### Monolith A software development architecture wherein your application is built as a single unit -- front-end, back-end, and database. Until... [Learn More](/content/learn/sdlc/monolith/index.html) ###### Multicloud Security Multicloud security is a practice that protects data and workloads across multiple cloud environments to prevent breaches and maintain... [Learn More](/content/learn/devsecops/multicloud-security/index.html) ###### NIST CSF 2.0 NIST CSF 2.0 is a voluntary cybersecurity framework published by the National Institute of Standards and... [Learn More](/content/learn/grc/nist-csf/index.html) ###### Nix Nix is a purely functional package manager and build system that stores dependencies in isolated, hash-addressed directories to... [Learn More](/content/learn/devops/nix/index.html) ###### npm npm is the default package manager for JavaScript and TypeScript that automates the process of discovering, installing, managing, and... [Learn More](/content/learn/devops/npm/index.html) ###### NuGet NuGet is a commonly-used package manager that simplifies dependency management by enabling developers to easily add, remove, and update... [Learn More](/content/learn/devops/nuget/index.html) ###### Operational Risk Management Operational risk management refers to the tactical practices and systematic processes used to identify, assess, and mitigate structural... [Learn More](/content/learn/devsecops/operational-risk-management/index.html) ###### Package Management Packages are bundles of code used to extend the functionality of an application. [Learn More](/content/learn/devops/package-management/index.html) ###### PCI DSS PCI DSS is a global security framework mandated by the Payment Card Industry Security... [Learn More](/content/learn/grc/pci-dss/index.html) ###### Principle of Least Privilege The principle of least privilege is a security concept that restricts user and system access to only necessary resources to minimize... [Learn More](/content/learn/devsecops/principle-of-least-privilege/index.html) ###### Private Cargo Registry A private Cargo registry serves as a centralized, controlled repository for Rust Cargo crate packages, offering enhanced security and... [Learn More](/content/learn/devops/how-to-run-a-private-cargo-registry/index.html) ###### Prompt Management Prompt management versions, tests, and governs LLM prompts in production, enabling prompt updates without redeploying the application. [Learn More](/content/learn/mlops/prompt-management/index.html) ###### Python Base Image A Python base image is a Docker or container image that contains a Python interpreter and often common Python packages. [Learn More](/content/learn/devops/docker-base-image-for-python/index.html) ###### Q-Learning Q-learning is a model-free reinforcement learning (RL) algorithm that enables agents to determine optimal actions by iteratively... [Learn More](/content/learn/mlops/q-learning/index.html) ###### RBAC Role-based access control (RBAC) is a security method that restricts system access based on user roles to... [Learn More](/content/learn/devsecops/rbac-role-based-access-control/index.html) ###### Real-Time Machine Learning Real-time machine learning is an infrastructure approach that processes streaming data to generate instantaneous predictions and enable... [Learn More](/content/learn/mlops/real-time-machine-learning/index.html) ###### Release Management Release management is the structured process of planning, coordinating, and overseeing software deployments. [Learn More](/content/learn/sdlc/release-management/index.html) ###### Remote Repository In the context of JFrog Artifactory, a repository type that contains only remote code with an original source outside of your local... [Learn More](/content/learn/remote-repository/index.html) ###### Repository A place to organize your source code or artifacts into one cohesive, organized group by application or project. Tools like GitHub are... [Learn More](/content/learn/repository/index.html) ###### SAST Static Application Security Testing (SAST) is an automated process that analyzes source code for flaws without running the software,... [Learn More](/content/learn/devsecops/sast/index.html) ###### SBOM A Software Bill of Materials (SBOM) is a comprehensive list of all the components used to build and run an application so organizations... [Learn More](/content/learn/grc/sbom/index.html) ###### SCA Software Composition Analysis (SCA) is the automated process of identifying third-party and open source... [Learn More](/content/learn/sdlc/sca/index.html) ###### SDLC The software development lifecycle (SDLC) is a structured process for building applications that ensures predictable delivery, software... [Learn More](/content/learn/sdlc/index.html) ###### Secrets Management Secrets management is the practice of securely storing, accessing, and controlling digital credentials to prevent unauthorized access... [Learn More](/content/learn/devsecops/secrets-management/index.html) ###### Security Misconfigurations Security misconfiguration is a flaw in the setup or maintenance of software assets that creates unintended vulnerabilities and expands... [Learn More](/content/learn/devsecops/security-misconfiguration/index.html) ###### Self-Healing A software supply chain that heals itself, is continuously secure, provable, and self-maintaining. [Learn More](/content/learn/devsecops/self-healing-software-supply-chain/index.html) ###### Semantic Release Semantic release is an automated software workflow that analyzes commit history to determine version bumps and publish changelogs... [Learn More](/content/learn/sdlc/semantic-release/index.html) ###### Serverless Computing Serverless computing is a cloud execution model where cloud providers manage infrastructure scaling to allow developers to focus on core... [Learn More](/content/learn/cloud-native/serverless-computing/index.html) ###### Service Mesh A tool that makes it easier to monitor and control the flow of information between the microservices that make up your application. This... [Learn More](/content/learn/service-mesh/index.html) ###### Shadow AI Shadow AI is the use of artificial intelligence tools within an organization without official IT... [Learn More](/content/learn/ai-security/shadow-ai/index.html) ###### Shift Left Shift left is the practice of integrating testing and security checks earlier in software development to fix vulnerabilities faster and... [Learn More](/content/learn/devsecops/shift-left/index.html) ###### SLSA Framework The SLSA Framework (Supply-chain Levels for Software Artifacts) is a security standard from the OpenSSF that secures the build process... [Learn More](/content/learn/grc/slsa-framework/index.html) ###### Software Artifact Repository A software artifact repository is a centralized storage system that manages and tracks build outputs and dependencies so teams can... [Learn More](/content/learn/devops/software-artifact-repository/index.html) ###### Software Artifacts A software artifact is any tangible or intangible item produced during development and deployment, including source code, binaries, and... [Learn More](/content/learn/devops/software-artifact/index.html) ###### Software Binaries A software binary is a machine-readable file compiled from human-readable source code that acts as the fundamental executable delivery... [Learn More](/content/learn/devops/software-binaries/index.html) ###### Software Governance Software governance is the framework of policies and controls managing software development, ensuring organizational alignment, security... [Learn More](/content/learn/grc/software-governance/index.html) ###### Software Provenance Software provenance is the metadata that records the origin, development, and delivery of software components. [Learn More](/content/learn/grc/software-provenance/index.html) ###### Software Supply Chain Software supply chain security is the practice of protecting the tools, libraries, and processes used to develop code so organizations... [Learn More](/content/learn/software-supply-chain/index.html) ###### Software Vulnerability A software vulnerability is a specific defect or weakness within an application's codebase, architecture, or configuration that exposes... [Learn More](/content/learn/devsecops/software-vulnerability/index.html) ###### Source Control A tool that helps manage your uncompiled source code into repositories. Examples are GitHub or Bitbucket. [Learn More](/content/learn/sdlc/source-control/index.html) ###### SSDF The Secure Software Development Framework (SSDF) is a set of NIST practices that embeds security into the development lifecycle to... [Learn More](/content/learn/grc/ssdf/index.html) ###### SSDLC A Secure Software Development Lifecycle (SSDLC) is the integration of security controls into every stage of software engineering to... [Learn More](/content/learn/devsecops/ssdlc-secure-software-development-lifecycle/index.html) ###### Threat Modeling Threat modeling is a design-time process for finding and mitigating security threats. [Learn More](/content/learn/devsecops/threat-modeling/index.html) ###### Typosquatting Typosquatting is a cyber attack where malicious actors develop software packages using names that... [Learn More](/content/learn/devsecops/typosquatting/index.html) ###### Ubuntu An Ubuntu base image is a lightweight version of the Ubuntu operating system designed specifically to act as the starting building block... [Learn More](/content/learn/cloud-native/docker-ubuntu-base-image/index.html) ###### Unit Tests A type of test that aims to verify functionality within a very specific, narrow scope, e.g., a specific function or class. [Learn More](/content/learn/sdlc/unit-tests/index.html) ###### Virtual Repository In the context of JFrog Artifactory, a type of repository that acts as an envelope around the local and remote repositories that make up... [Learn More](/content/learn/virtual-repository/index.html) ###### Vulnerability Management Vulnerability Management is the process of discovering, identifying, prioritizing and ultimately remediating vulnerabilities and risk in... [Learn More](/content/learn/devsecops/vulnerability-management/index.html) ###### Vulnerability Scanning Vulnerability scanning is the automated process of checking systems, networks, or applications for known security weaknesses to prevent... [Learn More](/content/learn/devsecops/vulnerability-scanning/index.html) ###### YAML A data serialization language designed to be human-readable, frequently used for configuration files in DevOps and beyond. [Learn More](/content/learn/yaml/index.html) ###### Zero-Day Vulnerability Zero-day vulnerability is a software security flaw unknown to the vendor that allows attackers to exploit systems before a fix exists,... [Learn More](/content/learn/devsecops/zero-day-vulnerability/index.html)