software-composition-analysis

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

ScanCode.io is a server to script and automate software composition analysis with pipelines. This project is sponsored by the European Commission, NLnet NGI0, the Google Summer of Code, nexB and others generous sponsors!

♾️ Collection of DevSecOps Notes + Resources + Courses + Tools

🔐 Shim to easily install OWASP dependency-check-cli into Python projects

This repository contains the container image scanning tool ORCA

Modular framework for file information extraction and dependency analysis to generate accurate SBOMs

The SCANOSS python package providing a simple, easy to consume library for interacting with SCANOSS APIs/Engine.

Practical, continuously verified open-source DevSecOps tools and a tested CI/CD security pipeline for GitHub Actions, covering SBOM, SAST, SCA, secrets, containers, and signing.

MiDas: Multi-granularity Detector for Vulnerability Fixes (IEEE TSE)

Offline-first, multi-language SAST with semantic data-flow analysis, deterministic security rules, SARIF/PDF reporting, Docker isolation, and optional local Ollama enrichment.

Deterministic, reachability-aware software composition analysis (SCA) engine — lockfile-first resolution, function- & cross-package reachability, patch-diff symbol mining, EPSS/KEV, SARIF + OpenVEX. Zero runtime dependencies.

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

Know your code and know your developers: git analytics, code ownership, key person risk, dependency and supply chain freshness, and tech landscape — from a CLI and local web UI.

Seamlessly integrate Veracode Agent-Based SCA scans with Azure DevOps build or release pipelines.

AWS native Static Application Security Testing (SAST) utility to find and eradicate vulnerable software packages stored in AWS CodeArtifact. Built for both real-time distributed and centralized deployments.

Build cross-language call graphs for Python packages. Perform vulnerability reachability analysis, detect unused code (bloat)

Hecate Cyber Defense - AI-powered vulnerability analysis

Golang SCA（Software Composition Analysis） 通过分析你的go.mod文件，协助你发现，Golang项目的依赖库是否存在漏洞

Benchmark Dataset for Evaluating Software Composition Analysis Tools