QFinch SCA resolves supported dependency manifests, identifies direct and transitive packages, correlates affected versions with normalized vulnerability intelligence and retains dependency evidence for reporting.
Move beyond package lists
- Dependency identity, ecosystem and detected version.
- Direct/transitive classification where the source graph supports it.
- Advisory identifiers, severity and affected-version assessment.
- Fix-version and remediation context where reliable upstream data exists.
- Dependency relationships, provenance and SBOM artifacts.
Honest completeness
Package identity, version resolution, graph coverage, ecosystem coverage, licenses and SPDX conversion are measured separately. Partial license data does not erase a valid graph, and a complete graph does not imply complete licensing evidence.
CTA: Scan a repository's dependencies