Secure Code Review and Application Security
Software Composition Analysis (SCA)
We identify the open source components and their dependencies used in your application. We show whether a known vulnerability is actually reachable in your application.
What it is
An application runs not only the packages you add directly but also their indirect dependencies. SCA lists these components and matches them to known vulnerability records. Many alerts in the raw output relate to functions your application never calls. Reachability analysis shows whether the vulnerable code is called from your application and distinguishes the real risk.
Scope
- Listing direct and indirect dependencies with versions
- Checking if the vulnerable function is called from your application
- Prioritizing by likelihood of exploitation using the CISA KEV catalog and EPSS
- Assessing the upgrade path and breaking changes
- Identifying abandoned packages and license risks
The need
When organizations need it
- When your component scanner produces hundreds of alerts and you cannot decide which to address first.
- When a customer or auditor asks why a component with a known vulnerability is still in use.
- When you need to create the inventory of third-party components in custom software required by PCI DSS.
Method
How we work
-
Inventory
We extract all dependencies, with their versions, from package manager and lock files.
-
Matching
We match the components to known vulnerability records and remove duplicates.
-
Reachability
For each critical finding, we check if the vulnerable code is called from your application.
-
Prioritization
We prioritize reachable and known-exploited vulnerabilities and show the upgrade path.
Outcome
What you have at the end
You know which component vulnerabilities pose a real risk in your application. Upgrades can be planned in order of actual impact.
Frequently asked questions
If a vulnerable component is not reachable, can we postpone the upgrade?
It is a valid reason to lower the priority. However, as your code changes, the vulnerable function may be called later. We therefore recommend upgrading the component in the next planned update.
What is the difference between SCA and an SBOM?
An SBOM is a record of the components in a release. SCA finds vulnerabilities in those components and assesses the real risk to your application.
Is license compliance in scope?
The licenses of the components are listed, and those conflicting with your policy are flagged. Legal assessment remains with your legal team.
Secure Code Review and Application Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting