> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Software Composition Analysis

> Deterministic dependency vulnerability scanning

Software Composition Analysis (SCA) scans your dependencies and third-party libraries for known vulnerabilities using deterministic CVE matching against vulnerability databases.

## How SCA Works

SCA performs deterministic dependency scanning:

1. **Dependency Discovery**: Analyzes package manifests to build complete dependency tree
2. **Vulnerability Matching**: Queries vulnerability databases (NVD, GitHub Advisory, OSV) for known CVEs
3. **Version Analysis**: Identifies vulnerable versions and available fixes
4. **License Detection**: Analyzes license information for compliance

**Powered by**: Trivy (industry-standard vulnerability scanner)

***

## Coverage

SCA scans dependencies across all major programming ecosystems.

### Package Managers Supported

<CardGroup cols={3}>
  <Card title="npm" icon="node-js">
    JavaScript/TypeScript
  </Card>

  <Card title="pip" icon="python">
    Python packages
  </Card>

  <Card title="Maven" icon="java">
    Java dependencies
  </Card>

  <Card title="NuGet" icon="microsoft">
    .NET packages
  </Card>

  <Card title="Go Modules" icon="golang">
    Go dependencies
  </Card>

  <Card title="Bundler" icon="gem">
    Ruby gems
  </Card>
</CardGroup>

### Transitive Dependencies

SCA analyzes your entire dependency tree, including transitive dependencies.

[View complete SCA support matrix →](/reference/sca-support-matrix)

***

## What SCA Finds

* **CVE vulnerabilities**: Known security issues in dependencies with CVE identifiers
* **Outdated packages**: Dependencies with available security updates
* **Vulnerable transitive dependencies**: Issues in sub-dependencies
* **License violations**: Incompatible or risky licenses

***

## Vulnerability Intelligence

SCA queries multiple vulnerability databases:

* NVD (National Vulnerability Database)
* GitHub Security Advisories
* OSV (Open Source Vulnerabilities)
* Vendor security bulletins
* Language-specific advisory databases

Each finding includes CVSS scores and EPSS scores for prioritization.

***

## Best Practices

* Scan dependencies on every build
* Prioritize high EPSS vulnerabilities
* Update direct dependencies first
* Use lock files for reproducible builds
* Monitor EPSS score changes

***

## Next Steps

<CardGroup cols={2}>
  <Card title="SCA Support Matrix" icon="box" href="/reference/sca-support-matrix">
    View complete package manager coverage
  </Card>

  <Card title="Managing Violations" icon="list-check" href="/findings/managing-violations">
    Workflow for fixing vulnerabilities
  </Card>
</CardGroup>