Request a demo
Please write your contact details and we will contact you soon
Verifying the security of third-party components in your source code, build artifacts, and container images at all stages of software development
Open source risks identification at all stages of software development cycle
Software Composition Analysis
CodeScoring.SCA
Problems solved by CodeScoring.SCA
The risks of Open Source usage are increasing, and manual security controls are not effective. CodeScoring.SCA automatically monitors the security of third-party components at different stages of the SDLC, allowing you to recognize problems in a timely manner and build effective AppSec and R&D.
> 200m
x13
85%
Open source projects with 5+ million ready-to-use packages and 75+ million versions.
Increase in number of known supply chain attacks over the 2022-2023 period: Dependency Confusion, Typosquatting, etc.
Vulnerabilities appear in the product through transitive dependencies. Such dependencies, same as direct dependencies, easily appear on the attack surface
Software Bill of Materials
Observability
Supply Chain Security
SBoM
Dependency Graph
License Compliance
Inventory
NVD CVE
OSV
GHSA
We collect data from multiple data feeds, including NVD CVE, GHSA, OSV, and more than a dozen of ecosystem feeds. Our process includes de-duplicating records and identifying errors in publicly available data. Private feeds from market experts are available as well. Information is supplemented with data on secure package versions, links to patches and public exploits.
Identification and correction of vulnerabilities
CodeScoring.SCA
key features
key features
Generate SBOMs and dependency graphs, with integrated checks in the CI pipeline, enforcing security and license compatibility policies. We perform thorough checks at the source code level, as well as on build artifacts and container images. Policies can be customized for each stage of the build process.
Working with Open Source
licenses
licenses
CodeScoring's regularly updated license database contains information on 2000+ Open Source licenses. The solution is accompanied by a vendor-specific license compatibility policy, and you can configure your own policies to prevent or block components with licenses containing export restrictions or overly restrictive terms of use.
Identification of components and building a Bill of Materials
The universal CodeScoring agent can be ran on the developer's local machine or in the pipeline at the required build stage. The system provides manifest analysis, transitive dependency resolution and identification of Open Source inclusions in the product code. As a result, a Software Bill of Materials (SBoM) is built, enriched with information about vulnerabilities and licenses.
Convenience of the software audit
The system builds a visualization of detected connections between components in the form of a convenient interactive graph, which will help you quickly identify the location of a problem in the codebase of the product. You can also scan code repositories for quick audit of components. The result is immediately visible.
Flexible security policies
When setting up a policy system, you can configure it not only based on the severity of a vulnerability but also by specific components of the CVSS vector or CWE. Additionally, you can track packages using a blacklist, age, author, or other criteria.
Solution at every stage
You can detect a problem at the stage of scanning a directory with code, checking a collected artifact or a container image. You can configure a separate policy for each stage to react to risks as early as possible. When a policy is triggered, you can send a notification to the mail, create a task in the task management system or send a notification to the SOAR/ASOC system. It is possible to configure recursive SBoM inspection as well.
Identification and correction
of vulnerabilities
of vulnerabilities
We collect data from multiple data feeds, including NVD CVE, GHSA, OSV, and more than a dozen of ecosystem feeds. Our process includes de-duplicating records and identifying errors in publicly available data. Private feeds from market experts are available as well. Information is supplemented with data on secure package versions, links to patches and public exploits.
CodeScoring.SCA
key features
key features
Software inventory: building SBoM and dependency graph, integrating checks into CI pipeline with blocking security and license compatibility policies. We perform checks at source code level, assembled artifacts and container images. It is possible to customize your policy for each separate build stage.
Working with Open Source licenses
CodeScoring's regularly updated license database contains information on 2000+ Open Source licenses. The solution is accompanied by a vendor-specific license compatibility policy, and you can configure your own policies to prevent or block components with licenses containing export restrictions or overly restrictive terms of use.
Identification of components
and building a Bill of Materials
and building a Bill of Materials
The universal CodeScoring agent can be ran on the developer's local machine or in the pipeline at the required build stage. The system provides manifest analysis, transitive dependency resolution and identification of Open Source inclusions in the product code. As a result, a Software Bill of Materials (SBoM) is built, enriched with information about vulnerabilities and licenses.
Convenience of the software audit
The system builds a visualization of detected connections between components in the form of a convenient interactive graph, which will help you quickly identify the location of a problem in the codebase of the product. You can also scan code repositories for quick audit of components. The result is immediately visible.
Solution at every stage
You can detect a problem at the stage of scanning a directory with code, checking a collected artifact or a container image. You can configure a separate policy for each stage to react to risks as early as possible. When a policy is triggered, you can send a notification to the mail, create a task in the task management system or send a notification to the SOAR/ASOC system. It is possible to configure recursive SBoM inspection as well.
NVD CVE
OSV
GHSA
Flexible security policies
When setting up a policy system, you can configure it not only based on the severity of a vulnerability but also by specific components of the CVSS vector or CWE. Additionally, you can track packages using a blacklist, age, author, or other criteria.
Identification and correction
of vulnerabilities
of vulnerabilities
We collect data from multiple data feeds, including NVD CVE, GHSA, OSV, and more than a dozen of ecosystem feeds. Our process includes de-duplicating records and identifying errors in publicly available data. Private feeds from market experts are available as well. Information is supplemented with data on secure package versions, links to patches and public exploits.
CodeScoring.SCA key features
Software inventory: building SBoM and dependency graph, integrating checks into CI pipeline with blocking security and license compatibility policies. We perform checks at source code level, assembled artifacts and container images. It is possible to customize your policy for each separate build stage.
Working with Open Source
licenses
licenses
CodeScoring's regularly updated license database contains information on 2000+ Open Source licenses. The solution is accompanied by a vendor-specific license compatibility policy, and you can configure your own policies to prevent or block components with licenses containing export restrictions or overly restrictive terms of use.
Identification of components
and building a Bill of Materials
and building a Bill of Materials
The universal CodeScoring agent can be ran on the developer's local machine or in the pipeline at the required build stage. The system provides manifest analysis, transitive dependency resolution and identification of Open Source inclusions in the product code. As a result, a Software Bill of Materials (SBoM) is built, enriched with information about vulnerabilities and licenses.
Convenience of the software audit
The system builds a visualization of detected connections between components in the form of a convenient interactive graph, which will help you quickly identify the location of a problem in the codebase of the product. You can also scan code repositories for quick audit of components. The result is immediately visible.
Flexible security policies
When setting up a policy system, you can configure it not only based on the severity of a vulnerability but also by specific components of the CVSS vector or CWE. Additionally, you can track packages using a blacklist, age, author, or other criteria.
OSV
NVD CVE
GHSA
Solution at every stage
You can detect a problem at the stage of scanning a directory with code, checking a collected artifact or a container image. You can configure a separate policy for each stage to react to risks as early as possible. When a policy is triggered, you can send a notification to the mail, create a task in the task management system or send a notification to the SOAR/ASOC system. It is possible to configure recursive SBoM inspection as well.
Supported systems
Integrated into the platform
Configure separate policies for each stage of the software development lifecycle
Public registries of OpenSource
Project assembly in
CI pipeline +
CI pipeline +
Safe
product
product
Source code control
Proxy repositories
Проверка компонентов в прокси-репозиториях: блокирование вредоносных и особо уязвимых пакетов
Регулярная проверка исходных кодов которые ещё не дошли до сборки и уведомление ответственных. Рекуррентное сканирование кода и SBoM.
Проверка в рамках конвейера разработки: от сканирования директории с кодом, проверки артефактов до сканирования образов
Convenient UI
CodeScoring provides a comfortable experience and clear interface to solve your problems
Working with dependencies
We have implemented a handy interactive relationship graph where you can immediately understand the relationships between components and get detailed information on problematic dependencies.
Convenient UI
CodeScoring provides a comfortable experience and clear interface to solve your problems
Working with dependencies
We have implemented a handy interactive relationship graph where you can immediately understand the relationships between components and get detailed information on problematic dependencies.
Request a demo
Here you can request a demo, check pricing, get an educational license, or partner with us.
