Zerethon IDE
Sign in

Dependency and security scanning

Intermediate 8 min read

Let automation find known vulnerabilities in your dependencies and code, and keep them patched.

Why it matters

Most applications are mostly dependencies, and new vulnerabilities in them are published every day. Scanning on every change and updating quickly closes the easiest door attackers use.

Where it fits — Security applies across these stages

  1. Plan & Design
  2. ● Develop
  3. Version control
  4. ● Verify
  5. Build & Package
  6. CI/CD
  7. ● Deploy
  8. ● Operate

What you will learn

  • Run the audit command of your package manager.
  • Turn on automated security updates for a repository.
  • Decide what to do with a reported vulnerability.

Before you start

Example 
npm audit               # known vulnerabilities in node_modules
composer audit          # the same for PHP
python -m pip install pip-audit && pip-audit   # and for Python
Run these in CI so a new vulnerable dependency fails the pull request.

Handling a finding

  • Is the vulnerable code actually used, and reachable by an attacker?
  • Is a fixed version available? Update, run the tests, release.
  • No fix yet: mitigate (configuration, removing the feature) and write down why you accepted the risk, with a date to look again.

Tip: Small, frequent dependency updates are easy to review. A year of skipped updates turns one security fix into a migration project.

Watch out: Scanners only know published vulnerabilities. They do not replace input validation, access checks and code review.

Official documentation and references

Reference

Learn next

Related topics

Done with this topic?

Reviewed 2026-10-23. Links go to the official documentation unless marked otherwise.