Socket

“If someone has derived a key with a vulnerable version, updating MetaMask to a newer version doesn’t help them. So we need to be able to detect if we are using a specific version as well as our historical usage of versions of that package. I have no idea how to figure that out across many repositories without Socket's Dependency tab.”

“The moment the Dependency tab showed up - we were already working on using an API to push this data in before it was available from historical scans because we really wanted that feature.”

“I’ve been using the Dependency section in the Socket dashboard to quickly find where we’re using that dependency, and this is something I wanted all along,”

“We use tools like npm audit to get information about known vulnerabilities, so we’re obviously tracking that, but that’s old news for us. We were not after another tool like that. We needed a tool that would automatically warn us about things no human has discovered yet. That’s where Socket shines. It occupies a totally different area in the software lifecycle.”

“Socket focuses on malicious packages and this is what we really were after,”

“Socket is doing a big chunk of work now to identify potential threats before they reach us,”

“In today's security landscape, there are far too many risks to just set static rules for everything, especially with the proliferation of AI," Stuts said. "I'm excited about where Socket is headed with AI-detected threats and how it will empower my growing team of security engineers.”

“My job is to reduce risk as much as we can without introducing developer friction and slowing down the business. Socket is a great tool for helping us do that,”

“Integrating Socket was remarkably straightforward, especially with its GitHub app," Stuts said. "It aligns seamlessly with our developers' current workflows, providing vital information exactly when decisions need to be made.”

“We weren't actively seeking a new solution in this space," Stuts said. "However, Socket resolved a gap in our application security posture and keeps both our security and developer team more informed. As Matt always says, it's about having 'more lead bullets' in our security arsenal, not relying on a single silver bullet to solve the supply chain security issue.”

“Our previous tools lacked usable automation capabilities,”

“Our previous approach relied heavily on manual processes,”

“We had SCA tools running, but they provided a surface-level view. These tools focused primarily on known vulnerabilities (CVEs) and didn't address the broader spectrum of supply chain security risks.”

“"We’re now unblocking researchers and engineers much faster, creating a cascading effect," Ziyad said. "People can conduct research and build more quickly while having greater confidence that they’re not making mistakes, thanks to Socket's automated checks in place."”

“"There are also intangible benefits—Socket is likely much better than me manually reviewing the seventh dependency of the day. The detections continue to improve autonomously, and it has been invaluable for us as we scale."”

“"Socket came in to handle much of the manual work, giving us greater confidence with standardized checks we could rely on," Ziyad said. "This eliminated the need to build those solutions in-house."”

“Where we’ve seen the most lift on our side is in dependency health and dependency sprawl,”

“Our primary challenge was managing our dependencies in a way that didn't slow us down,”