Software Composition Analysis
SCA that finds the vulnerable dependency and proves the risk
Connect a GitHub repo and TurboPentest scans your open-source dependencies with Grype for known CVEs, then validates every finding with an AI agent that classifies it to OWASP ASVS. Not just a dependency list. A pentest.
See a sample report →What is software composition analysis?
Software composition analysis (SCA) inventories every open-source and third-party dependency your application pulls in - direct and transitive - and checks each one against known-vulnerability data. Modern applications are mostly other people's code, so a single outdated package with a published CVE is often the easiest path into your app. SCA finds those risky dependencies at the source: the exact package and version, so a fix is a version bump, not a guess.
The catch with most open-source vulnerability scanning is noise: thousands of raw version matches, no idea which matter. TurboPentest solves that by pairing Grype with the Opengrep insecure-dependency rules and an AI agent that validates each finding and classifies it to an OWASP ASVS level - so you get a short list of confirmed issues, each with remediation and a Fix with AI prompt.
Grype
SCA engine matching your dependencies against known-CVE data
White-box run
OWASP ASVS
Paladin AI validates and classifies each source-code finding
Paladin AI
$99
per target, flat - SCA included in the white-box run at no extra charge
TurboPentest pricing
How SCA runs on TurboPentest
Connect your GitHub repo (read-only)
White-box mode turns on the source-code layer. Black-box testing still runs against your live app at the same time.
Grype scans your dependencies
Grype reads your manifests and lockfiles, resolves the direct and transitive dependency tree, and flags every package that carries a known CVE with its version and severity.
Paladin AI validates and triages
The Opengrep insecure-dependency and insecure-config rules add context, then Paladin AI validates each candidate finding, drops the noise, and classifies real findings to an OWASP ASVS level.
Get your report
Vulnerable dependencies with package-and-version detail, severity, remediation, and retest commands - plus the SAST and secrets findings from the same white-box pass.
What SCA covers
Every check is documented on the public Security Checks catalog with vulnerable-vs-safe examples and CWE/OWASP/ASVS mappings.
Known-CVE dependencies
Grype matches every direct and transitive package in your manifests and lockfiles against public vulnerability data, so a dependency with a published CVE is flagged with its version and severity.
Insecure-dependency rules
The IntegSec Opengrep rule pack adds insecure-dependency checks on top of Grype - dangerous package usage patterns that a version-only scan would miss.
Insecure configuration
Dependency and build configuration that ships dangerous defaults, disabled TLS verification, or permissive settings - each tagged CWE, OWASP, and ASVS.
OWASP ASVS classification
Paladin AI validates each candidate finding and classifies source-code findings to an OWASP ASVS level, so you get triaged, standards-mapped results instead of raw scanner output.
SCA is one layer. The white-box pass runs all three.
Grype finds the vulnerable dependency, SAST finds the flaw in your own code, and Gitleaks finds secrets committed to source. TurboPentest runs all three in the same white-box pass when you connect a repo - so a finding arrives already validated.
Software composition analysis FAQ
What is software composition analysis (SCA)?+
Software composition analysis (SCA) inventories the open-source and third-party dependencies your application pulls in - direct and transitive - and checks each one against known-vulnerability data. Modern apps are mostly other people's code, so a single outdated package with a published CVE can be the easiest way into your app. SCA surfaces those risky dependencies before an attacker does.
How does TurboPentest run SCA?+
Connect your GitHub repository read-only when you start a pentest. That turns on white-box mode, and TurboPentest runs Grype (SCA) across your manifests and lockfiles to find dependencies with known CVEs. The Opengrep rule pack adds insecure-dependency and insecure-config rules, and Paladin AI validates every candidate finding and classifies source-code findings to OWASP ASVS.
What is Grype?+
Grype is the SCA (software composition analysis) engine TurboPentest uses to match your dependencies against known-CVE data. It reads your package manifests and lockfiles, resolves the full dependency tree, and reports which packages carry published vulnerabilities - each with a version and severity you can act on.
Does SCA cost extra?+
No. $99 per target, flat. SCA is part of the white-box run at no extra charge when you connect a GitHub repo - the same run that includes SAST source-code analysis and Gitleaks secret scanning.
How is this different from a raw dependency scanner?+
A raw scanner dumps every version match it finds. TurboPentest pairs Grype with the Opengrep insecure-dependency rules and then Paladin AI validates each candidate finding and classifies it to an OWASP ASVS level - so you get a triaged short list with remediation and a Fix with AI prompt, and every check is documented on the public Security Checks catalog.
Scan your dependencies. Prove the risk. $99.
Connect a repo and get white-box SCA plus a live pentest in one run. See pricing
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.