SCA

SCA scans your dependency manifests + lockfiles for known-vulnerable packages, and records each dependency’s license.

​

What it catches

• Known CVEs in direct + transitive dependencies — CVSS-scored, and enriched with EPSS exploit-probability and CISA KEV (“known exploited”) flags for prioritisation
• Fix availability — whether a patched version exists; findings with no upstream fix are flagged as such (and can be excluded with --sca-ignore-unfixed)
• Dependency licenses — each package’s detected license is recorded on the finding and in the generated SBOM (copyleft licenses such as GPL / AGPL / LGPL / MPL are surfaced)

​

Ecosystems supported

The scanner reads whatever manifests and lockfiles are present in the repo. Analysis is offline — it does not call out to package registries — so a committed lockfile (the truth about what actually gets installed) gives the most accurate result.

​

Vulnerability sources

SCA uses TigerGate’s dependency-vulnerability (SCA) engine. It matches your dependencies against a vulnerability database that aggregates:

1. NVD — National Vulnerability Database (CVSS scores)
2. GitHub Security Advisories — GHSA IDs, often published earlier than NVD
3. OS distribution advisories — Alpine, Debian, Ubuntu, RHEL, Amazon, SUSE, Wolfi, etc. (used for OS/container packages)

TigerGate then enriches each CVE with EPSS exploit-probability scores and CISA KEV status. Findings de-duplicate by CVE / GHSA ID.

​

Auto-fix suggestions

For most CVE findings, TigerGate suggests the smallest patched version above the installed one, preferring a stable release.

• “[email protected] → 4.17.21 (patches CVE-2021-23337)”
• “[email protected] → 8.17.1 (patches CVE-2024-37890)”

To turn a finding into a ready-to-merge upgrade PR, use Auto-Fix from the finding’s detail view — it edits the manifest and opens the PR for you. Auto-Fix is available for repositories connected to TigerGate, not for findings uploaded from CI. When a CVE has no fixed version, no upgrade is suggested — wait for an upstream fix.

​

Dependency licenses

The scan resolves each dependency’s license — from the package’s own metadata and, offline, from any LICENSE/COPYING file in its source — and records it on the finding and in the generated SBOM. Copyleft licenses (GPL / AGPL / LGPL / MPL) are therefore visible across your dependency tree. Licenses that can’t be determined offline are shown as Unknown rather than guessed.

​

Suppressing false positives

A CVE that affects a code path you don’t use is a common false positive. Open the finding and, from the status dropdown, set its status to Accepted (or Won’t Fix / False Positive) — it drops off the open findings list.