> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types/dependency-sca-guardrails.md).
# Dependency (SCA) Guardrails
Vulnerability and hygiene checks on the dependencies a pull request introduces or changes.
Dependency guardrails evaluate the dependencies a pull request **introduces or modifies**, and re-check on every new commit. They come in two families — **Vulnerability** and **Hygiene** — both on the `Dependency` entity, so a single guardrail can combine rules of either kind (all conditions must match for it to fire). If any condition in a multi-rule guardrail cannot be evaluated, the whole execution is recorded as [**Error**](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails.md#execution-results) and no violation is raised, so a partial result never blocks a merge.
{% hint style="info" %}
Only dependencies the PR actually changes are evaluated — not your whole dependency tree — so feedback is fast and scoped to the change.
{% endhint %}
## Vulnerability rules
Flag dependencies with known vulnerabilities. The full catalog of vulnerability rules:
| Rule | Fires when… |
| ---------------------------------------------------- | --------------------------------------------------------- |
| **Active Exploit** | The vulnerability is being actively exploited in the wild |
| **Urgent Vulnerability** | Heeler Risk is Urgent |
| **CVSS Critical / High / Medium / Low** | CVSS falls in the given tier |
| **CVSS Severity Range** | CVSS meets a custom operator + threshold |
| **CVSS Attack Vector — Network** | The vector is network-exploitable |
| **CVSS Attack Complexity — Low** | Low attack complexity |
| **CVSS Privileges Required — None** | No privileges required |
| **CVSS User Interaction — None** | No user interaction required |
| **CVSS Confidentiality / Integrity Impact — High** | High C or I impact |
| **Fix Version Available / No Fix Version Available** | Gate on whether a fix exists |
CVSS rules read **CVSS 4.0 vectors as well as earlier versions**, so an advisory scored only with CVSS 4.0 is evaluated rather than skipped.
## Hygiene rules
Flag supply-chain and maintenance risk even when there's no CVE. The full catalog of hygiene rules:
| Rule | Fires when… |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Compromised Dependency** | The package matches Heeler's malicious-package intelligence |
| **Unapproved / Deprecated Dependency** | A specific package/version you disallow |
| **Unapproved License** | The license isn't on your approved list |
| **New Dependency** | Any newly added dependency |
| **Older Version Existing Dependency** | A downgrade |
| **Dependency Version Minimum Age** | The version is newer than a cooldown window |
| **Hygiene Score** | Below a chosen threshold |
| **Unmaintained Dependency (OSSF)** + Scorecard checks | Branch Protection, Binary Artifacts, Dangerous Workflows, Dependency Update Tool, Privilege Tokens, Signed Releases |
| **Unpinned Dependency** | Direct, transitive, or all |
Building a dependency guardrail — vulnerability conditions.
## Fixing violations
A **Vulnerability** violation on a **direct** dependency with an available fix is often auto-fixable — Heeler can open the upgrade for you. See [Guardrail Auto-Fix](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-auto-fix.md). Hygiene violations are not auto-fixable.
{% hint style="warning" %}
A dependency guardrail can't be combined with SAST, IaC, Secrets, SLO, or Agent Files rules — those use different entities. Create a dedicated guardrail for each.
{% endhint %}
## Worked example
See how this fits a proactive supply-chain program:
{% content-ref url="/pages/UKMcUu4uiPGFy8H7pw9o" %}
[Build a Supply Chain Security Program](/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/building-a-proactive-supply-chain-security-program.md)
{% endcontent-ref %}
## Related
* [Guardrail Types](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types.md) — the other rule families and the shared scope model.
* [Open Source (SCA)](/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca.md) — how these findings are detected and scored.
* [Guardrail Auto-Fix](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-auto-fix.md) — fixing an eligible violation on the pull request.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types/dependency-sca-guardrails.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
