Full glossary
Glossary · SCA
SCA: software composition analysis
How to find the vulnerabilities in the open source libraries a project uses.
Updated · 3-minute read
In one sentence
SCA (Software Composition Analysis) inventories a project's dependencies and checks them against known vulnerabilities and licenses.
What it looks at
Dependency files and lockfiles: which packages, in which versions, under which licenses.
What it doesn't look at
Vulnerabilities in your own code: that's the job of static analysis (SAST).
The trap
Many SCA tools forget the layer below: the version of the language itself, which may no longer receive fixes.
And LibWatch?
LibWatch runs SCA on your GitHub and GitLab repositories and your WordPress sites, and also tracks the end of life of your languages.