Skip to content
sec/atlas
back to the map
testing technique
stage: build
2 min read

SCA

Watches the code you did not write: third-party libraries, versions and known vulnerabilities.

DependabotSnykTrivyOWASP Dependency-Check

What it is

(Software Composition Analysis) inventories the project's dependencies, direct and transitive, and cross-references each version with public vulnerability databases (, GitHub Advisory, OSV) and license databases.

The premise: most of the code in a modern application (often 70 to 90%) comes from third parties. Your risk surface includes all of it, even if nobody on the team wrote a line of those libraries.

A real CVE: from lockfile to alert

The starting point is always a manifest or lockfile. Say the project depends on an old version of lodash:

package.jsonjson
{ "dependencies": { "lodash": "4.17.15" } }

Cross-referencing with the advisories

SCA takes each component+version from the lockfile and queries the vulnerability databases. For lodash 4.17.15, there is a real, well-known advisory:

advisory (OSV / GitHub Advisory)json
{
  "id": "CVE-2020-8203",
  "package": "lodash",
  "title": "Prototype pollution in zipObjectDeep",
  "affected": "< 4.17.19",
  "patched": "4.17.19",
  "severity": "HIGH"
}

Why the transitive version is the nightmare

The case gets interesting when the vulnerable package is not even in your package.json: it came in as a dependency of a dependency, three levels down. You never chose that lodash, but it is in your artifact running in production.

This is where the lockfile saves the day: it records the full tree, not just what is in the manifest. Without SCA and without a lockfile, the question 'do we use lodash 4.17.15?' has no quick answer, even in your own repository.

How it works, in short

  • reads manifests and lockfiles (package.json, package-lock, pom.xml, go.mod, requirements.txt)
  • builds the full dependency tree, including transitive ones
  • matches each component+version with published advisories and scores severity (, , known exploit)
  • opens automatic update PRs and generates the artifact's

Where it fits in the pipeline

On the PR and in the build, blocking new critical dependencies. And continuously after deploy: a new against an old version appears every day. The tool monitors the inventory and alerts (or opens a PR) when an already-used dependency becomes a risk.

Limitations

  • only knows about already published vulnerabilities; a in a dependency gets through
  • does not find flaws in your code: that is what and DAST are for
  • without a severity policy, it becomes a factory of ignored alerts
SCAComposition analysis: inventories third-party dependencies and cross-references them with known CVEs.see in glossary →NVDnational vulnerability databaseNIST's database that enriches each CVE with a CVSS score and an associated CWE. It is where most SCA tools get their data.see in glossary →CVSScommon vulnerability scoring systemA score from 0 to 10 that measures the technical severity of a vulnerability: how it is exploited (network or local, complexity, required privilege, user interaction) and what the impact is. 9.0+ is critical, but the number is theoretical: it does not know whether you are exposed.see in glossary →EPSSexploit prediction scoring systemThe probability (0 to 100%) that a CVE will actually be exploited in the next 30 days, based on evidence. It complements CVSS: a 9.8 with an EPSS of 0.1% can be less urgent than a 7.5 with an EPSS of 60%.see in glossary →SBOMThe software's ingredient list: dependencies, versions, licenses and hashes, in a standard format.see in glossary →CVEcommon vulnerabilities and exposuresThe unique identifier of ONE specific public vulnerability, in the format CVE-YEAR-NUMBER. E.g., CVE-2021-44228 is Log4Shell. It is the real instance, not the class of the problem.see in glossary →Zero-dayA vulnerability exploited before a public fix exists. Against a zero-day, only defense in depth and detection help in the moment.see in glossary →SASTStatic analysis: examines the code without running it. It finds issues through flow analysis, not guesswork.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

Unlocks

test what you learned

Loading questions…