> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca.md). # Open Source (SCA) Detect vulnerable and risky open-source dependencies — direct, transitive, and in your CI/CD — and drive them to closure by real-world risk. Heeler analyzes your open-source dependencies for security and supply-chain risk across every repository and the services those repositories deploy to. Because Heeler knows where each dependency actually runs, it separates the theoretical from the exploitable. {% hint style="info" %} **For developers and security engineers** triaging dependency risk. Depends on your **SCM** being connected; **registries and runtime environments** add the reachability and deployment context that makes prioritization real. See [Set Up Agentic Remediation](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-automated-remediation.md). {% endhint %}

The Active SCA Findings view: a Browse By rail (Findings / Remediations), filters for vulnerability, risk, severity, exploit threat, and fixability, and a table of CVE findings with package, bundle path, and repository. — The SCA **SAST Findings** view — every vulnerability instance, filterable by real-world risk (reachability, exposure, exploit threat).

## What Heeler detects * **Known vulnerabilities** — CVEs in **direct and transitive** dependencies, matched from advisory data with CVSS, EPSS, and known-exploited signals. * **Supply-chain hygiene** — compromised/malicious packages, unmaintained projects (OSSF Scorecard), too-new versions (minimum-age), unpinned versions, and downgrades. * **License risk** — dependencies whose license falls outside your policy. * **CI/CD supply chain** — the GitHub Actions and reusable workflows your repositories use, as a first-class dependency ecosystem. See [GitHub Actions Supply Chain](/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca/github-actions.md). ## How detection works Heeler builds a live dependency graph without changing your build: * **From your SCM** — it parses manifests and lockfiles (`pom.xml`, `package-lock.json`, `go.mod`, `requirements.txt`, …) to resolve direct and transitive dependencies. * **From your registries and runtime** — it ties each dependency to the artifacts and **running deployments** that use it, which is what makes reachability and exposure real rather than theoretical. * **Across ecosystems** — Maven, npm, PyPI, Go, NuGet, RubyGems, Cargo, and GitHub Actions. Reachability is established two ways — whether your code **reaches** the vulnerable function (call graph) and whether it's **loaded in a running deployment**. Both feed prioritization. **Function Reachability** is a filter in its own right on the SCA and Finding views, so a list can be narrowed to findings whose vulnerable symbol your code actually reaches. On the repository listing, a separate filter reports whether reachability has been computed for a repository at all, which distinguishes a repository with no reachable findings from one that was never analysed for reachability. ## Two ways to work: Remediations and Findings The SCA area has two toggled views (in the left **Browse By** rail), for two jobs — it opens on **Remediations** by default:


Remediations	Plan and assign fix work — findings grouped into one fix unit per package, with bulk auto-fix.	Remediations
SAST Findings	The full CVE inventory — one row per vulnerability instance, with detail and overrides.	SCA Findings

## The findings lifecycle Every SCA finding moves through **Active → Fixed → Deployed**, and Heeler confirms that last step from runtime so "fixed" never hides risk that's still running. See [the findings lifecycle](/mrecEO40m5D6bt7Pq5pE/findings.md#the-findings-lifecycle) for what each state means. ## In this section


Prioritization	How Heeler Risk is scored for dependencies.	SCA Prioritization
SAST Findings	The CVE inventory, finding detail, and overrides.	SCA Findings
Remediations	Grouped fixes, bulk auto-fix, and agent executions.	Remediations
GitHub Actions Supply Chain	CI/CD inventory, risk signals, and enforcement.	GitHub Actions Supply Chain

## Worked example The same capability inside a full triage workflow: {% content-ref url="/pages/2ucJQI28WyhzhNQvs51Y" %} [Determine Exploitability in Production](/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/determine-exploitability-in-production.md) {% endcontent-ref %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.