Technique · Supply chain

Dependency audit

Matches dependencies against advisory databases and license policy, and fails on known-vulnerable or disallowed packages.

Sub-techniques

Advisory matching V1015.001

Compare resolved versions with OSV, GitHub and ecosystem advisories.
Reachability-aware audit V1015.002

Report a vulnerable dependency only when the vulnerable function is called.
License policy V1015.003

Allow or deny dependencies by license.