SCA
Software composition analysis, checking third-party dependencies against known vulnerability databases.
Learn it through a story
- The Pipeline That Shipped the Bug Anyway (Cybersecurity for Juniors 3, Ch 8)
Related terms
- Safe harbour A promise not to pursue legal action against researchers who stay within an agreed, published testing scope.
- SAST Static application security testing, scanning source code itself for risky patterns.
- SBOM Software bill of materials, a complete list of every component a piece of software depends on.
- Scareware A scam that claims your device is infected, to frighten you into clicking.
- Secret scanning Automated tools that watch public code for exposed credentials.
- Secret sprawl Credentials scattered across many places, repos, notes, chats, with no central record of where they all live.