Do all SCA scanners work the same? Do they scan the source or the environment? I've seen some SCA that can scan a folder but also python safety just checks pypi. If both, what are advantages/disadvantages of each?

1 Answer 1


If you consider Python Safety or Bundler Audit SCA tools, then it's quite clear that not all SCA tools work the same and some only scan the dependency files while others scan the source code as well. As an example of a tool that scans the project's source code, I've used Black Duck, which looks at binaries, directories, and files and attempts to match those to know third-party dependencies to find vulnerabilities.

The advantages and disadvantages of each depend on your context. The most robust SCA tools that I'm familiar with that look beyond the dependency file tend to be more expensive, perhaps prohibitively so for some people or organizations. However, I've also noticed a number of false positives (or at least incorrect matches) with source scanning, where the wrong dependency is identified.

You should identify how your project is built, your threat model, and your risk tolerance when choosing tools.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .