Dependency Scanner

Dependency Scanner

When to Use

Trigger phrases:

• "Scan dependencies for vulnerabilities"
• "Check for outdated packages"
• "Audit project dependencies"
• "Generate SBOM"
• "License compliance check"
• "Supply chain security audit"

Use cases:

• Pre-release security checks
• CI/CD pipeline integration
• Compliance auditing (SOC2, GDPR, HIPAA)
• Open source license management
• Dependency update planning

When NOT to use:

• When using vendored dependencies with known state
• For runtime-only security (use SAST/DAST instead)

When NOT to Use

• For throwaway prototypes (skip the ceremony)
• When the fix is a single-line change with no side effects
• When the codebase already has a working solution

Overview

Dependency Scanner supports coding practices with best practices and proven patterns.

Workflow

# Example: TDD workflow
def test_user_creation():
    user = create_user(name="Alice", email="alice@example.com")
    assert user.name == "Alice"
    assert user.email == "alice@example.com"
    assert user.created_at is not None

def test_user_creation_invalid_email():
    with pytest.raises(ValidationError):
        create_user(name="Alice", email="invalid")

1. Understand requirements — Clarify acceptance criteria and constraints
2. Design solution — Plan architecture and identify patterns
3. Implement — Write code following project conventions
4. Test — Unit tests, integration tests, edge cases
5. Review — Code review for quality, security, and performance
6. Document — Update relevant docs and changelogs

Quality Gates

• All tests passing
• No lint errors or warnings
• Code coverage meets threshold (≥70%)
• No security vulnerabilities detected
• Documentation updated

Best Practices

• Follow SOLID principles and KISS
• Write self-documenting code with clear naming
• Handle errors explicitly — no silent failures
• Keep functions small and focused (<50 lines)
• Use immutable data patterns where possible

Anti-Rationalization Table

Process

1. Prepare — Gather requirements, verify prerequisites, set up environment
2. Execute — Run dependency scanner workflow with configured parameters
3. Verify — Validate output meets requirements, document results

Verification

• All steps executed successfully
• Results validated against acceptance criteria
• Error handling tested with edge cases
• Documentation updated with findings