Software Composition Analysis (SCA) — Know Your Dependency Risk | Nurbak
SOFTWARE COMPOSITION ANALYSIS

Software composition analysis that cuts the noise

Most of your code is other people's code. Nurbak's software composition analysis finds the vulnerable and risky dependencies you pulled in — and, crucially, tells you which ones you actually reach, so you fix what matters. Scan a public repo free.

github.com/
Public repos: free, no account. Results in minutes.

Maps your real dependency tree

Direct and transitive packages, so a vulnerability three levels deep doesn't hide from you.

Reachability, not just presence

A CVE in a package you never call isn't your emergency. It flags what your code actually reaches first.

Catches risky packages, not just CVEs

Abandoned, typo-squatted or suspicious dependencies — supply-chain risk a CVE list alone misses.

Private and self-owned model

Runs on our own model on ephemeral infra; your code never reaches a third-party AI and isn't stored.

How the SCA scan works

1

Paste a public repo, or connect a private one read-only.

2

We resolve your direct and transitive dependencies.

3

The model checks each for known and likely risk.

4

You get findings ranked by reachability and impact.

5

Re-scan after upgrades to confirm the risk is gone.

Software composition analysis FAQ

What is software composition analysis?

SCA analyzes the open-source and third-party components in your code to find known vulnerabilities and licensing or supply-chain risk. Nurbak adds reachability so you fix the dependencies your code actually uses first.

How is it different from a plain dependency scanner?

A plain scanner lists every CVE in every package, including ones you never call. Nurbak reasons about which dependencies your code actually reaches, so the list is short and actionable.

Is it free?

Scanning a public repository is free with no account. Private repos and continuous monitoring are on paid plans.

Is my code shared with a third party?

No. Analysis runs on our own model on ephemeral infrastructure; your code is deleted after the scan and never reaches OpenAI or Anthropic.

Run software composition analysis free

See which of your dependencies are actually putting you at risk in minutes.

Scan my repo