← Web Application Security (OWASP) learning pathWeb Application Security (OWASP) · Module 8 of 10
Vulnerable components and supply chain
Keep third-party libraries safe and updated.
📖 Key ideas
- Most apps depend on many open-source packages.
- Track dependencies and update them regularly.
- Use tools: npm audit, Dependabot, Snyk, OWASP Dependency-Check.
- Pin versions with lock files; review new packages before adding.
- Generate an SBOM (software bill of materials).
💡 Real-life example: Dependencies are ingredients from suppliers: check expiry dates and recalls before cooking.
DependencyThird-party package used by your app
DependabotAutomated dependency update tool
Lock filePins exact versions
SBOMSoftware Bill of Materials