Handle vulnerabilities
Scan the complete release
Check application dependencies, container packages, build tools, workflow components, and released artifacts without confusing scan coverage with proof of safety.
8 minute lesson
One package-manager audit sees one part of the supply chain. The shipped artifact may contain much more.
Scan the lockfile and final artifact, including operating-system packages and container layers. Keep advisory data current. Use multiple signals where the risk warrants it, and record which ecosystems and artifact types the scan does not cover.
A package-manager audit reports no findings, but the deployed container includes a vulnerable system library and an old workflow action. Each scanner sees only the ecosystem it understands.
More scanners also create duplicate and false-positive work. State the coverage boundary so the team knows which signal is missing and can triage one finding once.
Create a coverage table for source dependencies, build tools, workflow components, container packages, and the final artifact. Save one scan result for each covered class and name every uncovered class. Add a known safe test fixture or outdated disposable package and prove the expected scanner detects it without treating detection as proof of exploitability.
Lesson completed