Due to the "snippet match" nature of the scans, we found that it was too much effort to properly validate and catalog each open source component with every new project/product. Incremental results were also difficult to achieve even after consulting with the vendor. We found there were too many false positives and the code-snippet validator had bugs and presented too many false positives. My experience with this tool has turned me away from "snippet"-focused composition analysis. We have switched to one that uses more complete code signatures that do not require validation and review of findings in most cases.
Software Composition Analysis (SCA) solutions enable organizations to identify, analyze, and manage open-source components within their software projects, ensuring compliance and reducing security risks. SCA tools are designed to detect vulnerable dependencies and licensing issues in open-source libraries. By providing detailed reports on the state of components within a software project, these tools help organizations improve their security posture and ensure license compliance. SCA...
Due to the "snippet match" nature of the scans, we found that it was too much effort to properly validate and catalog each open source component with every new project/product. Incremental results were also difficult to achieve even after consulting with the vendor. We found there were too many false positives and the code-snippet validator had bugs and presented too many false positives. My experience with this tool has turned me away from "snippet"-focused composition analysis. We have switched to one that uses more complete code signatures that do not require validation and review of findings in most cases.