Stacklok

About Stacklok

Stacklok is a startup focused on enhancing software supply chain security. The company addresses the growing threat posed by sophisticated cyber actors targeting the software industry. Stacklok's primary product, Trusty, is designed to help developers and open-source communities ensure their software is secure and that they are using safe dependencies.

Trusty offers several key features to achieve this goal. It provides an "Activity Scoring" system, known as the Trusty Score, which uses statistical analysis of public GitHub data to benchmark the activity levels of software repositories. This helps users quickly gauge the trustworthiness of a repository. Additionally, Trusty offers "Package Provenance" by using Sigstore to verify the authenticity of software packages, ensuring they are tamper-proof and originate from a trusted source.

Another significant feature is "Package Recommendations," where Trusty employs generative AI to suggest related packages and their trust scores. This allows developers to find safer alternatives if needed. Trusty also continuously verifies that packages are signed, adding an extra layer of security.

Stacklok operates in the cybersecurity market, specifically focusing on software supply chain security. Its clients include developers, open-source communities, and organizations that rely on open-source software. The business model is primarily based on offering Trusty as a free service, accessible via a web app and a Visual Studio Code extension. This approach helps build a user base and trust within the developer community, potentially opening avenues for premium features or enterprise solutions in the future.

In summary, Stacklok is making significant strides in securing the software supply chain by providing tools that help developers make safer dependency choices and ensure the integrity of their software.