CodeLock

CodeLock builds software-supply-chain security tooling that operates at the code level rather than just scanning for known vulnerabilities. Its platform creates what the company calls a forensic chain of custody, cryptographically linking every code change to the developer who made it, so organizations can verify code authenticity and integrity from development through deployment. It also automates Software Bill of Materials (SBOM) generation and compliance dashboards mapped to frameworks like NIST 800-218 (the Secure Software Development Framework).

Founded in 2021 and headquartered in Ashburn, Virginia, CodeLock has raised roughly $6.72 million from a syndicate of angel and venture investors, including SoundBoard Venture Fund, Executive Venture Fund, Oakseed Ventures, and Sancus Ventures. The Department of Homeland Security has publicly stated that CodeLock "appears to have the capability to stop the most sophisticated malware," and the company has been recognized by TechCrunch among notable early-stage startups.

CodeLock’s angle — provenance and chain-of-custody verification rather than dependency scanning — addresses a different problem than traditional SAST/SCA tools: it’s aimed at proving that code wasn’t tampered with, in the mold of software supply-chain incidents like SolarWinds, rather than only flagging known-vulnerable components. As a small, young company, its independent, named enterprise track record is still thin relative to its DHS endorsement and funding.