Software composition analysis examines third-party and open-source dependencies to identify their components, licenses, and known vulnerabilities. It belongs in security-by-design work, especially during implementation, where teams select robust frameworks and libraries and keep them up to date. section 1.5
Use it to strengthen dependency hygiene:
- Review dependencies as part of the API development cycle rather than treating security as an implementation-only concern. section 1.5
- Prefer robust, secure frameworks and libraries, and keep them updated as the implementation evolves. section 1.5
Figure 1.6 Security by design fits into every step of the API development cycle. It encourages us to approach design, implementation, testing, and operations from a security point of view.
Use the security-by-design lifecycle to place dependency review alongside API design, implementation, testing, and operations. section 1.5
