CODESTAX / SCA & Dependencies
Software composition analysis. Know what you ship.
Make third-party dependencies part of your security review. CodeStax connects package inventory, vulnerability evidence, license information, and SBOM exports.
See plans and usage limitsWhat is SCA?
Software Composition Analysis (SCA) identifies third-party packages and checks them against vulnerability and license information. It helps teams understand the open-source components in their software, including dependencies introduced by other packages.
Direct and transitive dependency risk
Review packages your project declares and the dependencies those packages introduce. Dependency graphs and available reachability evidence help investigate the route from a vulnerable package to your application. Missing evidence should remain an open question.
Prioritization beyond a severity label
CVSS describes vulnerability severity. EPSS estimates the probability of exploitation in the wild over the next 30 days. CISA KEV identifies vulnerabilities known to have been exploited. Review these signals alongside your application context; none alone proves that your deployment is affected.
SBOM, VEX, and license evidence
Export a Software Bill of Materials (SBOM) in CycloneDX or SPDX format. Review license information and use Vulnerability Exploitability eXchange (VEX) workflows to record assessments. An inventory or assessment supports a review process; it does not certify compliance.
Support for common package ecosystems
Documented ecosystems include npm, pip, Maven, Gradle, Go modules, Cargo, Composer, RubyGems, and NuGet. The inventory depends on the manifests, lockfiles, and supported analysis available in each repository.
Common questions
What is the difference between SCA and SAST?
SCA investigates third-party packages, known vulnerabilities, and license information. SAST examines your source code for insecure patterns. Teams use them together because a dependency scan and a source-code scan answer different questions.
Does an SBOM tell me which vulnerabilities to fix?
An SBOM describes software components. Vulnerability matching, exploitation signals, and application context are additional inputs for prioritization. An SBOM alone is not a remediation plan.
Can CodeStax export CycloneDX and SPDX?
Yes. CodeStax documents SBOM exports in CycloneDX and SPDX formats. Review the exported inventory against the supported files in the repository and your downstream requirements.
YOUR NEXT STEP
Evaluate with your own repository.
Review the findings, test the workflow, and decide with evidence.