Scan dependencies for known vulnerabilities continuously

Description

The full resolved dependency tree of every project is matched against public vulnerability databases on every change and at least every {{ scan_interval_hours }} hours for the default branch and deployed versions.

Scan the lockfile or SBOM (resolved versions), not only the manifest (declared ranges).

Rationale

New vulnerabilities are published every day for code that has not changed. Scanning only on change misses them for projects that are not actively developed.

Impact

Findings must be triaged. Expect noise at first.

Parameters

The value used is your override, else the profile's, else the default. Bounds limit what an override may set.

Audit

1. Check that a dependency scan runs on change requests.
2. Check that a scheduled scan covers each default branch and deployed version at least every {{ scan_interval_hours }} hours.
3. Check that results reach the owning team.

Automated: every check must pass. Scanners report each check by its id.

postmortem

a scanner in pipelines, on change and on a schedule

command: postmortem harden --json
control: CB-DEP-VULN-001
coverage: partial

Remediation

1. Add a dependency scan to pipelines and a scheduled scan of default branches and deployed versions.
2. Route findings to the owning team.

References

• Open Source Vulnerability format OpenSSF, standard, accessed 2026-10-16
• NIST SP 800-218 - Secure Software Development Framework (SSDF) 1.1 NIST, standard, accessed 2026-10-16
• OWASP Software Component Verification Standard OWASP, standard, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-VULN-003 Fix vulnerable dependencies within set deadlines
• related CB-DEP-INV-002 Know where any package version is used within a set time

People and lifecycle