SCA - Software Composition Analysis

Path: /code/sca · Sidebar: Testing → Code Security → SCA

SCA inspects your third-party dependencies for known vulnerabilities, malicious packages and license risk across ecosystems (pip, npm, Maven, Go modules, Gemfile, and more).

What it checks

• Known vulnerabilities (CVEs) in your direct and transitive dependencies, enriched with advisories (NVD, GHSA, OSV).
• Reachability - whether the vulnerable function is actually called from your code, so you can deprioritise unreachable CVEs.
• Malicious packages - typosquats and known-bad packages.
• License compliance - flags licenses that violate your policy.

Run an SCA scan

1. From Repositories, choose Scan on a repo/product.
2. apPosture parses the lockfiles/manifests and resolves the dependency tree.
3. Findings land here and in Vulnerabilities, enriched with EPSS and KEV signals.

Reading an SCA finding

• Package & version, the fixed version to upgrade to, and the dependency path (direct vs. transitive).
• Advisory details, CVSS, EPSS score and KEV flag.
• Reachability verdict where computed.

The OSV feed

A curated vulnerability database ships by default. Turning on the OSV feed (OSV_ENABLED=true) augments it via opt-in egress to osv.dev for production-grade CVE breadth. In air-gapped setups, leave it off and rely on the curated DB.

Prioritise by reachability + KEV

A Critical CVE in an unreachable transitive dep is often lower real risk than a reachable Medium that's on the KEV list. Use the reachability and KEV columns to sort what to fix first - and let Priorities do it for you.