Chips, Dips, and Dependencies: Securing the Software Supply Chain with GraphQL

The integrity and security of the software supply chain are paramount. In 2023, Software supply chain attacks cost businesses an estimated $45.8 billion globally. The entire Shift-Left movement is just on paper invisible to software developers, we need to catch all signals like metadata-SBOMs-service relationship, consolidate them and make a well calculated decision.
Join this session as we see GUAC (Graph for Understanding Artifact Composition) an ambitious project leveraging the power of a graph database and GraphQL to provide a comprehensive view of software artifacts and their relationships, including security vulnerabilities in action. We'll delve into the GUAC data model and demonstrate how GraphQL queries can be used to identify vulnerable components, trace dependencies, and understand the provenance of software artifacts.

This talk isn't just for security teams, it's a playbook for developers, architects, and platform engineers who want to build secure-by-default systems that scale, self-correct, and stand up to real-world threats. We'll also touch on how the same architecture pattern helps in cost optimization, performance tuning, and compliance automation.