Yes. Maven scope decides which classpaths include a dependency and whether it passes to projects that depend on yours. A finding in a test scope library usually never ships, while a compile scope finding does. A good scan reports the scope so you can sort by it, but scope is a signal, not a verdict.
What the scopes mean
The Maven documentation lists six scopes:
| Scope | Meaning | Transitive |
|---|---|---|
| compile | Default, on all classpaths | Yes |
| provided | Supplied by the JDK or container at runtime | No |
| runtime | Needed to run, not to compile | Yes |
| test | Test compile and execution only | No |
| system | A local jar, not resolved from a repository | Not stated |
| import | For a pom in dependencyManagement | Not applicable |
The documentation also shows how a transitive dependency's scope changes based on its parent. A compile dependency whose own dependency is runtime becomes runtime. A compile dependency whose own dependency is provided or test is omitted.
Why this affects how you triage
A scanner that lists every artifact in the build may include test tools such as unit test frameworks. Most of those never run in production. Treating them like a vulnerable web framework wastes effort.
But be careful in three places.
- provided libraries are not in your jar, but they run in the container that hosts it. The risk sits in the environment, so someone else must patch it.
- test libraries run in CI, where your secrets live. A compromised test dependency is a supply chain risk even though it never ships.
- system scope jars are not fetched from a repository, so a scan that resolves from Maven coordinates may not see them at all.
What to check in your tool
- Does the report show the scope for each finding?
- Can you filter or set gates by scope, for example block on compile and runtime only?
- Does it resolve transitive dependencies, and does it apply the scope table above? OSV-Scanner's docs say transitive scanning is described for pom.xml, and that test dependencies are not yet supported in its dependency graph.
- Does it find system scope jars?
A simple policy
Block releases on compile and runtime findings above your threshold. Review provided findings with the platform owner. Review test findings on a schedule, with attention to CI secrets. For gating ideas see what a release gate should block on.
Safeguard's reachability analysis helps rank what remains after scope, and the free scan is at https://gold.safeguard.sh/scan.
Try it yourself
Open the exploitability demo and see how context changes which findings matter. Think of scope as one such context.
Click through it at your own pace, or open it full screen.
Quick check
Is a test scope dependency transitive?
No. Per the Maven documentation, test scope is not transitive and is used only for test compilation and execution.
Can I ignore every test scope finding?
Not blindly. Test dependencies run in CI, which often holds credentials, so review them on a schedule.
Sources
Last reviewed: 19 October 2026.
