Protocol 4.7Testing
Dependency Scanning
Checks for automated dependency vulnerability scanning: Dependabot config, native alerts (with severity breakdown and ecosystem coverage), and CI scanning tools. Quantitative alert data shows open/fixed counts and critical/high severity vulnerabilities.
Known vulnerabilities in dependencies are the most common attack vector. Automated scanning catches them before production.
Incidents that failed this protocol
Progress Software (MOVEit)May 2023civilizational
CVE-2023-34362 SQL injection in MOVEit Transfer leads to mass data theft
Dependency / vulnerability scanning did not flag the affected component in customer environments before active exploitation.
xz utils (Tukaani Project)Mar 2024civilizational
CVE-2024-3094 — multi-year social-engineering attack inserts backdoor into xz/liblzma
Dependency scanning did not detect the build-time payload; static analysis tools did not run on test fixtures.
See where your repo scores against Protocol 4.7 — and the other 49 — in 60 seconds.
Run a free scan →Full framework →