The safeguards map / 1.1 Code and dependencies
OWASP Dependency-Track
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A software composition analysis platform that builds a component inventory from CycloneDX bills of materials and checks it against vulnerability and policy data.
Where it sits
1.1 Code and dependencies (primary): Builds an inventory of a portfolio's components from CycloneDX bills of materials and checks them against vulnerability and policy data.
It builds an inventory of the components in software from CycloneDX bills of materials, continuously checks those components against vulnerability and policy data, and reports findings.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who run it
- Runs
- in CIby hand
Handoffs
consumes Software and AI inventory: CycloneDX SBOM
produces Vulnerability status: VEX
Collector's note
Stage 1 because it analyzes bills of materials; its build-failing policy checks are not placed in stage 3.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.