What should I do when a scanner reports a vulnerability with no fix?

Assess whether your code reaches the vulnerable function, look for mitigations or a replacement library, restrict exposure, and record the decision. Revisit it when a fix is released.

Does an SBOM make my software secure?

No. It makes you faster at finding what is affected by a newly disclosed flaw and gives customers transparency. Security comes from acting on what it reveals.

Dependency and Supply Chain Security: SCA, SBOMs, and Scanning

Introduction

Modern applications are mostly other people's code. Software Supply Chain Failures is now a top-three risk in the OWASP Top 10:2025, because a flaw or a compromise in one dependency affects everything that uses it. This lesson covers software composition analysis, which finds known vulnerabilities in your dependencies, and static analysis for your own code.

Prerequisites

A project with dependencies (Python or Node.js)
Docker installed for the Trivy example

Step-by-Step Guide

Step 1: Understand the risk and the basics

Vulnerabilities in libraries are published with identifiers, and attackers scan for applications using affected versions. Defend by knowing what you depend on, keeping it updated, and verifying where it comes from. Commit lock files so builds are reproducible, pin versions, prefer well-maintained packages, and avoid installing unknown packages with names that resemble popular ones, a trick called typosquatting.

Step 2: Automate updates with Dependabot

GitHub's Dependabot opens pull requests when dependencies have updates or security fixes. Enable it with a configuration file in your repository. Review its pull requests and let your tests decide whether they are safe to merge. Security updates are not delayed by version-update cooldown settings.

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"

Step 3: Scan for known vulnerabilities with OSV-Scanner

Google's OSV-Scanner checks your dependencies against the open OSV vulnerability database. It reads lock files and also software bills of materials, SBOMs, in the SPDX and CycloneDX formats. An SBOM is a machine-readable inventory of the components in your software, which helps you answer quickly whether you are affected when a new vulnerability is announced.

# install (one of)
brew install osv-scanner
winget install Google.OSVScanner

osv-scanner scan source -r .
osv-scanner scan source --lockfile=package-lock.json

Step 4: Scan files, images, and misconfigurations with Trivy

Trivy scans container images, file systems, and infrastructure-as-code for vulnerabilities, exposed secrets, and misconfigurations. Run it in CI so builds fail, or at least warn, when serious findings appear. Findings still need judgment: check whether the vulnerable code path is actually used and whether a fixed version exists.

trivy image python:3.13-slim
trivy fs --scanners vuln,secret,misconfig .

Step 5: Review your own Python code with Bandit

Bandit is a static analysis tool that builds a syntax tree of each Python file and flags common security problems such as weak hashes, unsafe use of shell commands, and hard-coded passwords. It cannot prove code is safe, and it produces some false positives, but it is a cheap first check. Combine it with the dependency scans in your pull request pipeline.

pip install bandit
bandit -r path/to/your/code
bandit -r . --severity-level high

FAQs

What should I do when a scanner reports a vulnerability with no fix?: Assess whether your code reaches the vulnerable function, look for mitigations or a replacement library, restrict exposure, and record the decision. Revisit it when a fix is released.
Does an SBOM make my software secure?: No. It makes you faster at finding what is affected by a newly disclosed flaw and gives customers transparency. Security comes from acting on what it reveals.

Summary

Know and verify your dependencies: commit lock files, automate updates with Dependabot, scan with OSV-Scanner and Trivy, keep SBOMs, and use Bandit on your own Python code, then act on the findings.