SCA

What Is SCA #

Software Composition Analysis (SCA) identifies the third-party libraries and open-source packages your application depends on and checks whether any carry known security vulnerabilities. The majority of code in any production service comes from the open-source ecosystem, making dependency risk one of the most important areas to monitor.

DryRun Security checks each dependency against known vulnerability databases, matching specific CVEs to affected version ranges across all major package ecosystems.

How Scanning Works #

DryRun Security runs SCA through two paths:

DeepScan - When a DeepScan is triggered from the dashboard, SCA runs as part of that scan, analyzing dependency manifests and lock files across the entire codebase at that point in time. This is the on-demand path for getting a current snapshot of supply chain risk whenever you need it.

Automatic background scanning - DryRun Security also scans active repositories automatically in the background to keep SCA findings current without requiring a manual trigger. Scan frequency is based on PR activity, so the most active repositories are kept up to date most often. See Scan Schedule below.

Scan Schedule #

Automatic SCA scans are scheduled based on repository PR activity over the last 30 days:

Activity	Frequency
High activity	Daily
Moderate activity	Weekly to bi-weekly
Low activity	Monthly
Inactive (fewer than 3 PRs in 30 days)	No automatic scan

Repositories that fall below the activity threshold do not receive automatic scans. Run a DeepScan manually from the dashboard to get current SCA findings for an inactive repository.

What’s Checked #

DryRun Security scans package manifests and lock files across all major ecosystems:

• JavaScript / Node.js - package-lock.json, yarn.lock
• Python - requirements.txt, Pipfile, pyproject.toml, poetry.lock, uv.lock
• Ruby - Gemfile, Gemfile.lock
• Java / Kotlin - pom.xml, gradle.lockfile, buildscript-gradle.lockfile, gradle/verification-metadata.xml
• Go - go.mod
• Rust - Cargo.lock
• .NET - *.csproj, deps.json, packages.config, packages.lock.json
• PHP - composer.lock

Note: For Gradle projects, SCA requires a committed dependency lock file. Standard Gradle build files (build.gradle, settings.gradle) are not used for dependency resolution. gradle.lockfile and buildscript-gradle.lockfile are supported at any directory level; gradle/verification-metadata.xml is only read from the repository root.

Viewing Findings #

SCA findings are available in three places in the DryRun Security dashboard:

• Risk Register - Filter by SCA agent type to see all dependency findings across repositories, alongside PR scan and DeepScan results.
• Repository pages - SCA findings for a specific repository are visible from that repository’s detail page in the dashboard.
• DeepScan page - SCA findings from a DeepScan run are included in the results and can be filtered separately.

SBOM #

SCA findings feed into SBOM (Software Bill of Materials) generation. DryRun Security generates a complete inventory of your software dependencies from both DeepScan and automatic background scans, which can be downloaded for compliance and audit purposes via the DryRun Security API.