Most of the code in an application arrived as someone else's package. Software composition analysis is how you keep that inventory honest. Here is what Safeguard's SCA page says.
What it is
SCA inventories the components in your software, including indirect dependencies, and tries to cut alert noise. The page lists these ecosystems: npm, PyPI, Maven, Gradle, Go modules, Cargo, RubyGems, Composer, NuGet and Hex. It reads manifests such as package.json, go.mod, Cargo.toml and Gemfile, and lockfiles such as package-lock.json, yarn.lock, poetry.lock and go.sum.
Reachability is a call graph verdict on whether a vulnerable function is actually invoked from your code path. Findings are marked reachable or filtered out. Risk scores draw on CVSS, EPSS, KEV and business impact.
Outputs include SBOMs in CycloneDX, SPDX 2.3 and SPDX 3.0, inline pull request comments with a suggested safe upgrade, and CI integration with GitHub Actions, GitLab CI, Jenkins and Azure DevOps. An air-gapped mode runs on an offline advisory mirror.
How to use it
- Scan with your lockfiles present. Lockfile aware pinning needs them.
- Sort by reachable first, then by KEV status.
- Read the suggested upgrade and run your tests.
- Export an SBOM when a customer asks.
The free scan at gold.safeguard.sh/scan checks a manifest in the browser, up to 100 dependencies, with no login.
One thing to check
The page says Griffin AI fixes issues with no manual pull request reviews in one place, and says fixes go through human approval in another. Settle which applies to your tenant before you rely on either.
Quick check
What does a reachability verdict tell you?
Whether a vulnerable function is actually called from your code path.
