Software Composition Analysis
ELI5 — The Vibe Check
Software Composition Analysis is a fancy name for 'checking your dependencies for known vulnerabilities and license issues.' Tools like Snyk and Dependabot do this. It's like running a background check on every ingredient in your recipe.
Real Talk
Software Composition Analysis tools identify open-source and third-party components in applications, map them to known vulnerabilities (CVE databases), analyze license compliance, and assess risk. They operate on manifests, lockfiles, and sometimes binary analysis.
When You'll Hear This
"SCA found that our project transitively depends on a package with a critical CVE." / "License compliance in SCA caught a GPL dependency that would've caused legal issues."
Related Terms
Dependabot
Dependabot is GitHub's robot that checks your dependencies for updates and security vulnerabilities, then opens PRs to fix them.
SBOM
An SBOM is a complete ingredient list for your software — every library, every dependency, every version. Like food nutrition labels but for code.
SCA
SCA checks if the libraries you're using have known vulnerabilities. You didn't write the bug, but you imported it. That lodash version from 2019?
Supply Chain Security
Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.