Dependency Scanning
Also known as: SCA, Software Composition Analysis
Dependency scanning (Software Composition Analysis, or SCA) automatically checks a project's third-party libraries and packages against known vulnerability databases, flagging any dependency with a publicly disclosed security issue — a common and often overlooked attack surface, since most applications include far more third-party code than code they wrote themselves.
Modern applications routinely pull in hundreds or thousands of transitive dependencies (dependencies of dependencies) that no developer on the team directly chose or is likely even aware of — dependency scanning automates the otherwise impossible task of manually tracking every one of those for newly disclosed vulnerabilities.
Tools (Dependabot, Snyk, npm audit) typically run continuously — checking on every commit and issuing alerts as new vulnerabilities are disclosed against packages already in use — since a dependency that was safe last week can become a known vulnerability overnight the moment a CVE is published against it.
