Software Composition Analysis
SCA that finds the vulnerable dependency and proves the risk
Connect a GitHub repo and TurboPentest scans your open-source dependencies with Dep Scanner for known CVEs, then validates every finding with an AI agent that classifies it to OWASP ASVS. Not just a dependency list. A pentest.
See a sample report →What is software composition analysis?
Software composition analysis (SCA) inventories every open-source and third-party dependency your application pulls in - direct and transitive - and checks each one against known-vulnerability data. Modern applications are mostly other people's code, so a single outdated package with a published CVE is often the easiest path into your app. SCA finds those risky dependencies at the source: the exact package and version, so a fix is a version bump, not a guess.
The catch with most open-source vulnerability scanning is noise: thousands of raw version matches, no idea which matter. TurboPentest solves that by pairing Dep Scanner with the Code Scanner insecure-dependency rules and an AI agent that validates each finding and classifies it to an OWASP ASVS level - so you get a short list of confirmed issues, each with remediation and a Fix with AI prompt.
Dep Scanner
SCA engine matching your dependencies against known-CVE data
White-box run
OWASP ASVS
Paladin AI validates and classifies each source-code finding
Paladin AI
$99
per target, flat - SCA included in the white-box run at no extra charge
TurboPentest pricing
How SCA runs on TurboPentest
Connect your GitHub repo (read-only)
White-box mode turns on the source-code layer. Black-box testing still runs against your live app at the same time.
Dep Scanner scans your dependencies
Dep Scanner reads your manifests and lockfiles, resolves the direct and transitive dependency tree, and flags every package that carries a known CVE with its version and severity.
Paladin AI validates and triages
The Code Scanner insecure-dependency and insecure-config rules add context, then Paladin AI validates each candidate finding, drops the noise, and classifies real findings to an OWASP ASVS level.
Get your report
Vulnerable dependencies with package-and-version detail, severity, remediation, and retest commands - plus the SAST and secrets findings from the same white-box pass.
What SCA covers
Every check is documented on the public Security Checks catalog with vulnerable-vs-safe examples and CWE/OWASP/ASVS mappings.
Known-CVE dependencies
Dep Scanner matches every direct and transitive package in your manifests and lockfiles against public vulnerability data, so a dependency with a published CVE is flagged with its version and severity.
Insecure-dependency rules
The IntegSec Code Scanner rule pack adds insecure-dependency checks on top of Dep Scanner - dangerous package usage patterns that a version-only scan would miss.
Insecure configuration
Dependency and build configuration that ships dangerous defaults, disabled TLS verification, or permissive settings - each tagged CWE, OWASP, and ASVS.
OWASP ASVS classification
Paladin AI validates each candidate finding and classifies source-code findings to an OWASP ASVS level, so you get triaged, standards-mapped results instead of raw scanner output.
SCA is one layer. The white-box pass runs all three.
Dep Scanner finds the vulnerable dependency, SAST finds the flaw in your own code, and Secret Scanner finds secrets committed to source. TurboPentest runs all three in the same white-box pass when you connect a repo - so a finding arrives already validated.
Software composition analysis FAQ
What is software composition analysis (SCA)?+
Software composition analysis (SCA) inventories the open-source and third-party dependencies your application pulls in - direct and transitive - and checks each one against known-vulnerability data. Modern apps are mostly other people's code, so a single outdated package with a published CVE can be the easiest way into your app. SCA surfaces those risky dependencies before an attacker does.
How does TurboPentest run SCA?+
Connect your GitHub repository read-only when you start a pentest. That turns on white-box mode, and TurboPentest runs Dep Scanner (SCA) across your manifests and lockfiles to find dependencies with known CVEs. The Code Scanner rule pack adds insecure-dependency and insecure-config rules, and Paladin AI validates every candidate finding and classifies source-code findings to OWASP ASVS.
What is Dep Scanner?+
Dep Scanner is the SCA (software composition analysis) engine TurboPentest uses to match your dependencies against known-CVE data. It reads your package manifests and lockfiles, resolves the full dependency tree, and reports which packages carry published vulnerabilities - each with a version and severity you can act on.
Does SCA cost extra?+
No. $99 per target, flat. SCA is part of the white-box run at no extra charge when you connect a GitHub repo - the same run that includes SAST source-code analysis and Secret Scanner secret scanning.
How is this different from a raw dependency scanner?+
A raw scanner dumps every version match it finds. TurboPentest pairs Dep Scanner with the Code Scanner insecure-dependency rules and then Paladin AI validates each candidate finding and classifies it to an OWASP ASVS level - so you get a triaged short list with remediation and a Fix with AI prompt, and every check is documented on the public Security Checks catalog.
Scan your dependencies. Prove the risk. $99.
Connect a repo and get white-box SCA plus a live pentest in one run. See pricing