{"ref":"capability:vulnerability-scanning","page":"/capabilities/vulnerability-scanning","json":"/capabilities/vulnerability-scanning.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"vulnerability-scanning","name":"Vulnerability scanning","domain":"security-and-compliance","ecosystems":["btp","cap","ui5"],"universal":false,"description":"Finding known vulnerabilities in the open-source components an application depends on, in the project's dependency tree before it is deployed and in the application once it runs, and following each one until it is fixed. Checking a file somebody uploaded is [malware scanning](capability:malware-scanning), and checking an application's own source for flaws is [static analysis](capability:abap-static-analysis).","short":"Finding known vulnerabilities in an app's open-source dependencies","core_coverage":{"state":"core-only","assessed_at":"2026-09-15","what_core_does":"SAP ships this on BTP as [Application Vulnerability Report](artifact:btp-application-vulnerability-report), which detects vulnerabilities in the open-source components of customer-deployed applications in an SAP BTP landscape.","where_it_stops":"At the SAP BTP landscape and at the report: it covers applications deployed there, and its data reaches IT service management workflows or ticketing systems through a CAP-based OData API.","sources":[{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/aceeda52-0db8-4bfa-9695-5efc065d7af4","title":"SAP Discovery Center — Application Vulnerability Report","checked":"2026-09-15","quote":"Frequent security issues in open-source components endanger business data in customer-deployed applications. Use application vulnerability report to detect and remediate any vulnerabilities in your SAP BTP landscape."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/aceeda52-0db8-4bfa-9695-5efc065d7af4","title":"SAP Discovery Center — Application Vulnerability Report","checked":"2026-09-15","quote":"Use SAP Cloud Application Programming Model (CAP)-based OData API to integrate the report data into IT Service Management (ITSM) workflows or ticketing systems."},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/aceeda52-0db8-4bfa-9695-5efc065d7af4","title":"SAP Discovery Center — Application Vulnerability Report","checked":"2026-09-15","quote":"What is Application Vulnerability Report (Beta)"},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/aceeda52-0db8-4bfa-9695-5efc065d7af4","title":"SAP Discovery Center — Application Vulnerability Report","checked":"2026-09-15","quote":"AWS / CLOUD FOUNDRY / Europe (Frankfurt)"}],"note":"The record lists one plan, available in AWS / Cloud Foundry / Europe (Frankfurt), and its documentation link is titled \"What is [Application Vulnerability Report](artifact:btp-application-vulnerability-report) (Beta)\"."},"coverage_by_ecosystem":{"cap":{"state":"unmapped","assessed_at":"2026-10-26","where_it_stops":"capire's security overview puts patch and vulnerability management on the application provider. The check before deployment is npm's own `npm audit`, which reads the project's dependencies against the registry's advisories; on BTP, deployed applications are the [Application Vulnerability Report](artifact:btp-application-vulnerability-report)'s.","sources":[{"url":"https://cap.cloud.sap/docs/guides/security/overview","title":"Security Overview, capire","checked":"2026-10-26","quote":"must establish patch and vulnerability management"},{"url":"https://cap.cloud.sap/docs/guides/security/overview","title":"Security Overview, capire","checked":"2026-10-26","quote":"For example, component versions must be updated and credentials must be rotated regularly."},{"url":"https://docs.npmjs.com/cli/v10/commands/npm-audit","title":"npm audit, npm Docs","checked":"2026-10-26","quote":"asks for a report of known vulnerabilities"}]},"ui5":{"state":"unmapped","assessed_at":"2026-10-26","where_it_stops":"The check before deployment is npm's own `npm audit` for a project with a package.json, which sends the project's dependencies to the registry and reports known vulnerabilities; on BTP, deployed applications are the [Application Vulnerability Report](artifact:btp-application-vulnerability-report)'s.","sources":[{"url":"https://docs.npmjs.com/cli/v10/commands/npm-audit","title":"npm audit, npm Docs","checked":"2026-10-26","quote":"asks for a report of known vulnerabilities"},{"url":"https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities","title":"About security audits, npm Docs","checked":"2026-10-26","quote":"A security audit is an assessment of package dependencies for security vulnerabilities."}]}},"history":[{"date":"2026-10-26","field":"ecosystems","from":"btp","to":"btp, cap, ui5","reason":"Public feedback issue #10: known vulnerabilities in open-source dependencies are checked in the project's dependency tree on CAP Node.js and UI5 projects before anything is deployed. One node per concern; the BTP wording about deployed applications is kept in framing_by_ecosystem.btp."},{"date":"2026-10-26","field":"description","from":"Finding known vulnerabilities in the open-source components of applications already deployed, and following each one until it is fixed. Checking a file somebody uploaded is [malware scanning](capability:malware-scanning), and checking an application's own source for flaws is [static analysis](capability:abap-static-analysis).","to":"Finding known vulnerabilities in the open-source components an application depends on, in the project's dependency tree before it is deployed and in the application once it runs, and following each one until it is fixed. Checking a file somebody uploaded is [malware scanning](capability:malware-scanning), and checking an application's own source for flaws is [static analysis](capability:abap-static-analysis).","reason":"Public feedback issue #10. CAP and UI5 coverage assessed as unmapped: no atlas artifact provides the dependency-tree check there yet."}],"drafted_with_ai":true,"framing_by_ecosystem":{"btp":{"description":"Finding known vulnerabilities in the open-source components of applications already deployed, and following each one until it is fixed. [Application Vulnerability Report](artifact:btp-application-vulnerability-report) is SAP's answer for applications deployed in a BTP landscape."},"cap":{"description":"Finding known vulnerabilities in the open-source packages a CAP project installs, before the application is deployed. `npm audit` reports them for a [Node.js](external:nodejs) project's dependency tree."},"ui5":{"description":"Finding known vulnerabilities in the npm packages a UI5 project's tooling and dependencies install, before the application is deployed. `npm audit` reports them for any project with a package.json."}}},"sap_delivery":{"door":"btp","all":{"built_in":[],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:btp-application-vulnerability-report","name":"Application Vulnerability Report","json":"/artifacts/btp-application-vulnerability-report.json"}]},"by_flavor":{}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:btp-application-vulnerability-report","name":"Application Vulnerability Report","json":"/artifacts/btp-application-vulnerability-report.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:qualiture-audit-summary","name":"audit-summary","json":"/artifacts/qualiture-audit-summary.json","ecosystem":"general","origin_ring":"independent"}],"samples":[],"explained_by":[],"normative_context":[]}}