Software Composition Analysis
SCA that finds the vulnerable dependency and proves the risk
Connect a GitHub repo and TurboPentest checks your open-source dependencies for known CVEs, then validates every finding with an AI agent that classifies it to OWASP ASVS. Not just a dependency list. A pentest.
See a sample report →What is software composition analysis?
Software composition analysis (SCA) inventories every open-source and third-party dependency your application pulls in - direct and transitive - and checks each one against known-vulnerability data. Modern applications are mostly other people's code, so a single outdated package with a published CVE is often the easiest path into your app. SCA finds those risky dependencies at the source: the exact package and version, so a fix is a version bump, not a guess.
The catch with most open-source vulnerability tools is noise: thousands of raw version matches, no idea which matter. TurboPentest solves that by pairing dependency checks with the code analysis insecure-dependency rules and an AI agent that validates each finding and classifies it to an OWASP ASVS level, so you get a short list of confirmed issues, each with remediation and a Fix with AI prompt.
Dependency Checks
SCA engine matching your dependencies against known-CVE data
White-box run
OWASP ASVS
Paladin AI validates and classifies each source-code finding
Paladin AI
$99
per target, flat - SCA included in the white-box run at no extra charge
TurboPentest pricing
How SCA runs on TurboPentest
Connect your GitHub repo (read-only)
White-box mode turns on the source-code layer. Black-box testing still runs against your live app at the same time.
Dependency checks review your dependencies
Dependency checks read your manifests and lockfiles, resolve the direct and transitive dependency tree, and flag every package that carries a known CVE with its version and severity.
Paladin AI validates and triages
The code analysis insecure-dependency and insecure-config rules add context, then Paladin AI validates each candidate finding, drops the noise, and classifies real findings to an OWASP ASVS level.
Get your report
Vulnerable dependencies with package-and-version detail, severity, remediation, and retest commands - plus the SAST and secrets findings from the same white-box pass.
What SCA covers
Every check is documented on the public Security Checks catalog with vulnerable-vs-safe examples and CWE/OWASP/ASVS mappings.
Known-CVE dependencies
Dependency checks match every direct and transitive package in your manifests and lockfiles against public vulnerability data, so a dependency with a published CVE is flagged with its version and severity.
Insecure-dependency rules
The IntegSec code analysis rule pack adds insecure-dependency checks on top of dependency checks: dangerous package usage patterns that a version-only check would miss.
Insecure configuration
Dependency and build configuration that ships dangerous defaults, disabled TLS verification, or permissive settings - each tagged CWE, OWASP, and ASVS.
OWASP ASVS classification
Paladin AI validates each candidate finding and classifies source-code findings to an OWASP ASVS level, so you get triaged, standards-mapped results instead of raw tool output.
SCA is one layer. The white-box pass runs all three.
Dependency checks find the vulnerable dependency, SAST finds the flaw in your own code, and secret detection finds secrets committed to source. TurboPentest runs all three in the same white-box pass when you connect a repo, so a finding arrives already validated.
Software composition analysis FAQ
What is software composition analysis (SCA)?+
Software composition analysis (SCA) inventories the open-source and third-party dependencies your application pulls in - direct and transitive - and checks each one against known-vulnerability data. Modern apps are mostly other people's code, so a single outdated package with a published CVE can be the easiest way into your app. SCA surfaces those risky dependencies before an attacker does.
How does TurboPentest run SCA?+
Connect your GitHub repository read-only when you start a pentest. That turns on white-box mode, and TurboPentest runs dependency checks (SCA) across your manifests and lockfiles to find dependencies with known CVEs. The code analysis rule pack adds insecure-dependency and insecure-config rules, and Paladin AI validates every candidate finding and classifies source-code findings to OWASP ASVS.
What are dependency checks?+
Dependency checks are the SCA (software composition analysis) engine TurboPentest uses to match your dependencies against known-CVE data. They read your package manifests and lockfiles, resolve the full dependency tree, and report which packages carry published vulnerabilities, each with a version and severity you can act on.
Does SCA cost extra?+
No. $99 per target, flat. SCA is part of the white-box run at no extra charge when you connect a GitHub repo, the same run that includes SAST source-code analysis and secret detection.
How is this different from a raw dependency checker?+
A raw dependency checker dumps every version match it finds. TurboPentest pairs dependency checks with the code analysis insecure-dependency rules and then Paladin AI validates each candidate finding and classifies it to an OWASP ASVS level, so you get a triaged short list with remediation and a Fix with AI prompt, and every check is documented on the public Security Checks catalog.
Test your dependencies. Prove the risk. $99.
Connect a repo and get white-box SCA plus a live pentest in one run. See pricing