Software composition analysis
On this page
Software composition analysis (SCA) reviews dependencies described by the manifests and lockfiles in an authorized project source. The review is limited to the source you provide; it is not an inventory of an unapproved package registry or production host.
#Inputs
Select the approved project source in Workbench and include the dependency manifests and lockfiles used by that project. The formats and advisory coverage depend on the selected source and current product coverage.
#What results mean
Review the affected component, version, advisory, and project context together. A package or advisory match is a signal to investigate; it does not by itself prove that the dependency is reachable or exploitable in your application. Coverage is not universal across every format or advisory.
#Review and remediation
Check that the reported package and version belong to the project and determine how the application uses them. Follow your team's policy to update or remove affected dependencies, then review the source again. Do not treat an advisory identifier alone as a production-impact decision.
#Availability
SCA and SBOM export are included in the Professional package. See Plans and licensing for package details. Access is arranged by email; request access.
#Related guides
Need a workflow that is not documented here? Email contact@eresussec.com.