Software Composition Analysis (SCA)
Scan dependencies for known CVEs with OWASP Dependency-Check, Snyk, or GitHub Dependabot.
What is SCA?
Software Composition Analysis (SCA) identifies open-source dependencies in your project and checks them against vulnerability databases (NVD, CVE, GitHub Advisory). It also flags license compliance issues.
Why Third-Party Dependencies Are Risky
Modern applications use hundreds of open-source libraries. A single vulnerable library can expose the entire application. The 2021 Log4Shell vulnerability (CVE-2021-44228) affected millions of Java applications because of one widely-used logging library.
All lessons in this course
- SAST and DAST in CI/CD Pipelines
- Software Composition Analysis (SCA)
- Secrets Scanning and Hardcoded Credentials
- Security Champions and Threat Modeling