Lion Cipher Lab
Scan your dependencies for known vulnerabilities
- AppSec / DevSecOps
- Beginner
- ~35 min
- Free · no account required
Why it matters
Almost none of the code in a modern application is code you wrote. When you run 'npm install' or 'pip install', you pull in a handful of libraries you chose -- and those libraries pull in libraries of their own, which pull in more, until a small project quietly depends on hundreds of packages maintained by strangers. That borrowed code runs with the same privileges as yours, so a security flaw in any one of it becomes a flaw in your app. When such a flaw is discovered, it is written up as a CVE -- a Common Vulnerabilities and Exposures record, the public, numbered entry that describes a…
What you'll learn
- what a dependency and a transitive dependency actually are
- why known-vulnerable libraries (CVEs) are a top breach vector
- running the free built-in scanner: npm audit (Node) and pip-audit (Python)
- reading an SCA report: package, severity, and the version it is fixed in
- fixing a finding by upgrading, then testing that nothing broke
- automating scans with GitHub Dependabot and OWASP Dependency-Check
- the honest limits of SCA: advisory lag, false positives, transitive deps
Steps in this lab
- The uncomfortable truth: most of your code is not yours
- The vocabulary: CVE, advisory database, and SCA
- Open a terminal and go to your project
- Node path: run npm audit and read the report
- Python path: run pip-audit and read the report
- Fix a finding by upgrading -- then test
- Make it automatic and broaden your reach
- The honest limits -- and why this habit still wins