Managing insecure dependencies is a major challenge in software security. While databases provide vulnerability lists, manual risk management is arduous. Learn how you can use a tool developed in house to manage this arduous task.

One of the greatest challenges in software security is the potential insecurity of the dependencies we rely on. Various databases exist that provide lists of known vulnerabilities, allowing us to determine whether a specific version of software is vulnerable. However, managing this risk manually can be an arduous task. In the modern era of software development, it is crucial to identify the usage of vulnerable dependencies within our code. While software solutions like Dependabot by GitHub exist to assist in managing these risks, they do not utilize GitHub’s Code Scanning platform to analyze the problem before suggesting a fix. This becomes problematic because a dependency itself may be vulnerable, but the code we utilize from that dependency may not be. As a result, there is no need to update the dependency unless we are actually using the vulnerable code. To address this issue, I aimed to develop a solution specifically for individuals familiar with the Code Scanning platform, which would notify them of vulnerable dependencies only if they are using the vulnerable parts of the dependency. This approach eliminates the need for blanket updates of dependencies and offers a more precise and efficient solution.

To tackle this challenge, I developed a tool that leverages the capabilities of GitHub’s Code Scanning platform. By integrating with this platform, my solution analyzes the codebase to identify any vulnerable dependencies in use. Unlike existing solutions, which often recommend updating all dependencies regardless of whether vulnerable code is being utilized, my tool provides targeted and accurate information. It examines the specific code sections that rely on the vulnerable dependency and alerts the user accordingly. This approach saves significant time and effort, eliminating the need for unnecessary updates and reducing the risk of introducing new bugs through blanket dependency updates. By focusing on the actual usage of vulnerable code within dependencies, this tool enhances the overall security of software development processes while minimizing disruptions. For individuals who are already familiar with GitHub’s Code Scanning platform, my solution offers a valuable addition to their security arsenal, ensuring they are promptly informed of any relevant vulnerabilities without the need for exhaustive manual checks or broad updates.