thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

DevOps & Automation · Intermediate

Software Composition Analysis (SCA)

Identifying open-source and third-party dependencies in software and checking them for known vulnerabilities and license issues.

Definition

SCA tools such as Dependabot, Snyk, OWASP Dependency-Check, and Mend inventory dependencies (including transitive ones) and map them to CVEs. Results can generate automated upgrade pull requests.

Example

Dependabot opens a PR bumping a library from 2.14.1 to 2.17.1 to fix a critical CVE.

Exam tip

Vulnerable third-party libraries are found by SCA, not SAST.

Don't confuse it with

Related terms