Spotlight on a New Feature of the JFrog Platform
summary
JFrog Platform's new contextual analysis inspects Docker images by combining dependency scanners and in-container code analysis to triage and prioritize vulnerabilities. A demo on a GitHub app shows reducing 127 image-level findings to about 15–16 criticals, then down to 3 applicable vulnerabilities (1 critical) after container-aware code analysis, reproducing a Spring4Shell RCE via URL and pinpointing the exact file/parameter to fix; the tool also detects embedded secrets and outbound data in built images.
AI-written summary · about
related talks
26mDigging Into Your App's Container Image Layers for Sneaky Vulnerabilities
18mGlobal security at maximum velocity: Multi-Region and hybrid DevSecOps
36mJFrog Platform Innovation: Reloading Development Teams
41mIdentifying and Mitigating Cloud and Container Threats
36mElevating Innovation: GitHub & JFrog Paving the Way Forward
29mA journey of the thousand binaries
29mFrom Vulnerabilities to Vigilance
35mSecuring Containers by Breaking In