What is Mend.io?
Mend.io, formerly known as WhiteSource, is an enterprise-grade application security platform designed to help organizations manage the risks associated with open-source software. It provides a suite of tools for Software Composition Analysis (SCA), Static Application Security Testing (SAST), and license compliance management. By integrating directly into the DevOps pipeline, Mend.io automates the entire process of detecting, prioritizing, and remediating security vulnerabilities and licensing issues, allowing development teams to build secure software faster.
Key Features
- Software Composition Analysis (SCA): Automatically detects all open-source components and their dependencies in your codebase, identifying known vulnerabilities and license types.
- Static Application Security Testing (SAST): Scans your proprietary code for security weaknesses and flaws without needing to execute the application.
- Automated Remediation: Provides automated fix pull requests and precise recommendations to help developers quickly resolve vulnerabilities.
- License Compliance: Identifies and reports on all open-source licenses in your projects, ensuring compliance with company policies and legal requirements.
- Supply Chain Security: Protects against malicious packages and software supply chain attacks with advanced detection capabilities.
- CI/CD Integration: Seamlessly integrates with popular CI/CD tools, repositories, and package managers to provide continuous security scanning.
Use Cases
- DevSecOps Implementation: Integrating automated security checks directly into the development workflow to catch vulnerabilities early.
- Vulnerability Management: Continuously monitoring applications for new and existing open-source vulnerabilities.
- Software Audits: Generating comprehensive reports (Software Bill of Materials - SBOM) for security audits and compliance verification.
- License Policy Enforcement: Ensuring all dependencies adhere to predefined corporate license policies.
- Mergers & Acquisitions: Quickly assessing the security and license risk of a target company’s software assets.
Getting Started
Mend.io offers a Unified CLI tool that allows you to scan your projects from the command line. Here’s a basic example of how to run a Software Composition Analysis (SCA) scan on a project directory.
First, you need to install and configure the Mend CLI according to the official documentation.
```bash
Navigate to your project’s root directory
cd /path/to/your-project
Run the SCA scan
This command analyzes your dependencies and identifies vulnerabilities and licenses.
mend sca
The scan results will be uploaded to your Mend.io organization dashboard, where you can view detailed reports, prioritize findings, and manage remediation.
Pricing
Mend.io operates on a subscription-based pricing model tailored for enterprise customers. The pricing typically depends on the number of developers, the specific products required (SCA, SAST, etc.), and the level of support needed. They offer a free trial and customized demos to prospective clients.