SCA (Dependency Vulnerabilities)
Often the open source you pull in is a larger attack surface than the code you wrote yourself. SCA checks the known vulnerabilities (CVEs) in the dependencies your source code uses. For the Source Code service, it reads the package manifest and analyzes direct and transitive dependencies together.
SCA also works on container images, servers (hosts), and uploaded SBOMs. This document takes the source dependency perspective. For other targets, see Image SCA, Host OS vulnerabilities, and SBOM upload.
What it reads
- Package manifests and lock files (for example,
package.json/package-lock.json,go.mod/go.sum,requirements.txt,pom.xml) - It tracks not only direct dependencies but also transitive dependencies (dependencies of dependencies).
Supported ecosystems
Dependency scanning supports the following package ecosystems.
- npm / yarn / pnpm (Node.js)
- PyPI (pip / poetry / pipenv)
- RubyGems (Bundler)
- Maven / Gradle (Java)
- Go modules
- Cargo (Rust)
- Composer (PHP)
- NuGet (.NET)
- pub (Dart)
- Conan (C / C++)
- mix (Elixir)
- Swift PM / CocoaPods
- OS packages (Alpine / Debian / Ubuntu / RHEL / Amazon Linux, etc.)
Prioritization information
Because dependency CVEs are numerous, each item is shown with information that helps you prioritize action.
- KEV A vulnerability confirmed to be actively exploited. Handle it first, regardless of severity.
- EPSS : the probability of being exploited in the near future.
- CWE : vulnerability type classification (used for compliance mapping).
Continuous monitoring
Registered components are continuously monitored even after a scan. When a new CVE is published, it is reflected in the inventory without a rescan and an alert is raised. (See Security News.)
Handling results
If a CVE does not actually affect you (for example, the vulnerable function is not used), you can mark it as accepted risk or false positive, and export that judgment as a VEX to communicate the rationale to customers and auditors.