Software Composition Analysis (SCA)

wikipedia:Software Composition Analysis

Options

• License risk management
• Policy management
• Vulnerability identification
• Vulnerability management
• SDLC integration
• Container scanning
• Serverless scanning

Reports

• Audit report
• Risk report

Products

• Flexera: FlexNet Code Insight
• FOSSA: Compliance*
• Fortify Static Code Analyzer (SCA)
• GitLab Ultimate: GitLab Security Dashboards
• GitHub code scanning (Sep 2020)
• JFrog Xray
• Snyk (2015, UK)
• Sonatype
• Synopsys: Black Duck and Black Duck Binary Analysis
• Veracode: Veracode SCA (srcclr) and SourceClear SCA
• WhiteHat Security: WhiteHat Sentinel SCA
• WhiteSource (2011): automatic remediation
• SonarQube (2006-2007)

Related terms

• Application Security Testing (AST): SAST, DAST
• npm audit
• docker scan
• Amazon Inspector
• Static program analysis: eslint

See also

• CA Technologies
• Binary repository manager
• Software Composition Analysis (SCA): Flexera, FOSSA, GitLab Ultimate, JFrog Xray, Snyk, Sonatype, Synopsys: Black Duck, Veracode, WhiteHat Security, WhiteSource, Bill of Materials (BOM), Semgrep, Clair
• Application Security Testing (SAST, DAST, IAST): Fortify WebInspect, GitLab Ultimate, flawfinder, Kubesec, Coverity, SonarQube, SCA, Checkmarx

https://github.blog/2020-09-30-code-scanning-is-now-available/