Software Composition Analysis

Problem

Your application contains 500 open-source dependencies. Your own code may be secure while one library contains a known vulnerability.

Solution — SCA

Tools such as Snyk Open Source and GitHub Dependabot identify package names and versions from dependency files, including libraries brought in by other libraries, and compare them against databases of known vulnerabilities. Repository integrations or CI scans report affected packages and available fixed versions. For example, Dependabot can open a pull request to upgrade a vulnerable dependency when security updates are enabled.

Application
   ↓
Dependency inventory
   ↓
Known vulnerabilities

Core idea: SCA finds security risk introduced through third-party software components.