Mend.io (formerly known as WhiteSource) is the maker of application security products that effortlessly protect content created by developers. Mend.io removes the burden of application security and enables teams to create and deliver high-quality, secure code.

The Mend Applied Security Platform includes Mend SCA and Mend SAST.

Our plugin integrates with your repositories, build tools, CI servers and more. It calculates the digital signatures of all components without scanning the code. It then cross-references the digital signatures with those in the Mend.io database to detect open source components in your product. An up-to-date report is generated immediately with all components and issues detected.

If you have integrated Mend SCA with the generation pipeline, a report is generated every time you run generation. If you have integrated Mend SCA with the developer's repository, Mend SCA detects and displays vulnerabilities as soon as code is written and/or accessed to the repository.

Our SAST product uses a hybrid architecture. It scans your software locally, so your source code never leaves your premises. Analytics, automated remediation, reporting and other functions are all done in the cloud. This gives you the best of both worlds - a local scanning program that gives you peace of mind and no management or maintenance headaches.

The Mend.io database is the largest and most mature open source vulnerability database. It contains over 300,000 vulnerable components aggregated from CVE/NVD and a variety of other sources such as the GitHub issue tracker, security bulletins, and open source project issue trackers.

Mend.io uses a proprietary, patented algorithm that matches between the vulnerability and the affected version, thus ensuring that no false positives are wasted on developer time.

Yes, Mend.io automatically enforces policies throughout the software development process. You can define policies based on the severity of security vulnerabilities, open source license type, severity of software bugs, age of components, etc. You can approve, reject, start the approval flow or open problem tickets according to your conditions and definitions.

Additionally, Mend.io offers a browser extension that notifies developers whether a component complies with an organization's policies before it is downloaded.

We offer a variety of reports to help you monitor all your open source activities, such as inventory reports, due diligence reports, high severity error reports, vulnerability reports, and more.

Some plug-ins for Mend SCA can be used in isolated environments by generating an update request and saving the request locally as a text file. For these plug-ins, the files can later be moved to an online environment for automatic or manual updates.