Does Apigee provide any assurance around security vulnerabilities in OSS or 3rd-party libraries used

[#1]

Does Apigee provide any assurance around security vulnerabilities in OSS or 3rd-party libraries used in Apigee Edge?

For example, tools such as OWASP Dependency Check or https://snyk.io/

[davissean]

It is very common to build tools like this into your Continuous Integration pipeline. For example adding a Maven build step to use Snyk to check the versions of node_modules that you are using in your proxy, and failing if there are any issues.

Or are you referring to the open source components such as nginx, qpid and zookeeper?

[#3]

Thanks Sean, yes, we would certainly use such tools to check any dependencies when developing our own proxies and backends, but I'm referring to the Apigee product itself so the components you mention and any other libraries which Apigee Edge has been built with.