SCA Scanning

sca (software composition analysis) scanning involves analyzing the components and dependencies of a software application to identify potential security vulnerabilities, license, and compliance issues sca analysis soos inspects your manifest files and files to identify the open source software used by your applications dependency tree creation after identifying directly referenced open source software, soos’s patented dependency resolution builds the full dependency tree and catalogs introduction paths vulnerability matching using the full set of packages and dependencies, soos matches packages to vulnerabilities soos will identify available fixes via new vulnerability free versions and provides automatic pull requests for fixes through github license matching using the full set of packages and dependencies, soos matches packages to licenses governance policies soos’s suite of governance policies may be run against the packages and licenses which were identified issue creation issues are created for any vulnerabilities, governance policies, unknown packages, and more report generation reports for each sca scan are created and accessible via the soos developer, legal, security, and compliance dashboards