Microsoft Talks About WhiteSource

This video demonstrates how to integrate WhiteSource Bolt (now Mend Bolt) into Visual Studio Team Services (VSTS), now known as Azure DevOps, to automatically scan your open source components for vulnerabilities and license compliance.
You’ll learn how to set up the extension, run your first scan, and interpret the results—all within your existing CI/CD pipeline.

Modern applications rely heavily on open source libraries, but those libraries can introduce hidden security and compliance risks. Mend Bolt is a free extension that brings automated open source scanning directly into your build process in Azure DevOps.

With this integration, every build triggers a scan of your dependencies, helping you catch vulnerabilities and license issues early—before they reach production. The scan runs automatically and delivers a detailed, easy-to-read report inside your DevOps project dashboard.

In this video, you'll see how to:

Install the Mend Bolt extension from the Azure DevOps Marketplace

Configure your build definition to include a Bolt scan step

Run a build and generate a vulnerability report

Review results including severity, affected components, and suggested remediations

Use the results to improve open source security posture without leaving your DevOps environment

Mend Bolt gives teams visibility and control over open source risk with zero manual setup, making it an ideal choice for small teams or those just getting started with AppSec.