dependency-scanning
Safeguard articles tagged "dependency-scanning" — guides, analysis, and best practices for software supply chain and application security.
42 articles
Pull-request-level dependency scanning on GitHub
Socket.dev popularized flagging risky dependencies inside GitHub pull requests. Here's how that scanning works, where it falls short, and what closes the gaps.
An SCA Tools List That Matches How You Actually Ship
A candid SCA tools list for teams that need dependency and license scanning wired into CI, covering open-source scanners and commercial platforms and how to tell them apart.
Best Open Source SCA Tools in 2026 (Tested on a Real Monorepo)
OSV-Scanner, Trivy, Grype, Dependency-Check, and dep-scan, all run against the same 4,300-dependency monorepo. Recall, false positives, and scan times measured.
Vulnerability Checker: How to Scan Your Code and Websites for Flaws
What a vulnerability checker does, the different kinds (dependency, website, container), and how to choose and use one to actually reduce risk rather than generate noise.
Python Security Tools: The Ones Worth Running in Your Pipeline
A practitioner's tour of the Python security tools worth running: pip-audit for dependencies, Bandit for code, and detect-secrets, with CI examples.
What Is a Package Vulnerability Scanner and How Do You Pick One?
A package vulnerability scanner checks your dependencies against known-CVE databases so you catch risky libraries before they ship. Here is how they work and what separates a good one.
SCA in DevSecOps: Automating Dependency Security in CI/CD
SCA in DevSecOps means wiring software composition analysis into your pipeline so vulnerable dependencies get caught on every commit instead of at audit time.
How to Audit Python Dependencies with pip-audit (and What It Misses)
pip-audit checks your Python dependencies against the PyPA advisory database in one command. Here is how to run it well in CI, and the four gaps it leaves open.
How to set up software composition analysis (SCA)
A practical, step-by-step guide to setting up software composition analysis: choosing a tool, setting policy, and integrating scans into CI/CD.
Using cargo-audit and the RustSec Advisory Database to ca...
A hands-on cargo-audit tutorial: scan Rust dependencies against the RustSec advisory database, interpret results, and block vulnerable crates before they ship.
Auditing Ruby dependencies for known CVEs with bundler-audit
A step-by-step bundler-audit tutorial for scanning Ruby gems against known CVEs, patching vulnerable dependencies, and enforcing the check in CI.
Finding vulnerable .NET dependencies with dotnet list pac...
A step-by-step guide to scanning C# projects for vulnerable NuGet packages using dotnet list package --vulnerable, plus how to fix and monitor them continuously.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.