NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Software Composition Analysis (SCA)
Master SCA fundamentals, SBOM generation, and license compliance to secure the software supply chain against vulnerable open-source dependencies.
Room tasks
1What Is SCA and Why Does It Matter
2CVEs, CVSS and Dependency Trees
3Scanning Dependencies with Trivy & OWASP Dependency-Check
5Guided Lab: Remediating Vulnerable Dependencies in a Pipeline
Frequently Asked Questions
What is software composition analysis?
SCA identifies the open-source libraries in your application, including transitive dependencies, and checks them for known vulnerabilities and license issues so you can update or replace risky components.
How is SCA different from SAST?
SCA examines third-party components and their known vulnerabilities, while SAST inspects the code you wrote. They address different risks, so most secure development programmes run both.
What is a transitive dependency?
A transitive dependency is a package your direct dependencies rely on. You may not choose it, yet its vulnerabilities affect you. The Codelivly SCA room is free and shows hands-on how to find them.