What you will learn
- Run SAST and SCA
- Scan container images
- Triage findings
New to this? Start here
The basics, in plain English
Vulnerability scanning means using tools to automatically search your code, containers, and dependencies for known security weaknesses. It is like a spell-checker, but for security holes. Running scans regularly catches problems before attackers do.
- Scanning
- Automatically inspecting code or systems to find known weaknesses.
- Dependency
- Outside code your app relies on, which can carry its own vulnerabilities.
- CVE
- A public ID for a known security flaw, used so everyone refers to it the same way.
- False positive
- A warning that turns out not to be a real problem.
- Severity
- How dangerous a found weakness is, from low to critical.
- Patch
- An update that fixes a known vulnerability.
01
Layers of scanning
SAST analyzes source, SCA checks dependencies, image scanners check containers. The hard part is triaging real risk from noise.
Finished this topic?
Mark it done to earn 100 XP and keep your streak alive.