Vulnerability scanning
Finding known vulnerabilities in the open-source components an application depends on, in the project's dependency tree before it is deployed and in the application once it runs, and following each one until it is fixed. Checking a file somebody uploaded is malware scanningMalware scanningChecking a file somebody uploaded before anyone else can download it — where the scan runs, what happens to the file meanwhile, and who is told when it fails.SAP only, and checking an application's own source for flaws is static analysisStatic analysisCatching problems in code before it runs: naming, obsolete statements, security findings, and compatibility with a target environment. Style linting, security scanning and cloud-readiness checks are often treated as one concern.SAP and community, narrow by design.
Overview
Finding known vulnerabilities in the open-source components of applications already deployed, and following each one until it is fixed. Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp is SAP's answer for applications deployed in a BTP landscape.
SAP ships this on BTP as Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp, which detects vulnerabilities in the open-source components of customer-deployed applications in an SAP BTP landscape.
Not covered: At the SAP BTP landscape and at the report: it covers applications deployed there, and its data reaches IT service management workflows or ticketing systems through a CAP-based OData API.
The record lists one plan, available in AWS / Cloud Foundry / Europe (Frankfurt), and its documentation link is titled "What is Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp (Beta)".
No community artifact is documented here.
Finding known vulnerabilities in the open-source packages a CAP project installs, before the application is deployed. npm audit reports them for a Node.jsNode.jsA cross-platform JavaScript runtime that servers, command line tools and scripts written in JavaScript are run with. For the things here, the prerequisite a repository names when its build is a set of npm scripts. project's dependency tree.
No core answer is documented.
Not covered: capire's security overview puts patch and vulnerability management on the application provider. The check before deployment is npm's own npm audit, which reads the project's dependencies against the registry's advisories; on BTP, deployed applications are the Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp's.
Finding known vulnerabilities in the npm packages a UI5 project's tooling and dependencies install, before the application is deployed. npm audit reports them for any project with a package.json.
No core answer is documented.
Not covered: The check before deployment is npm's own npm audit for a project with a package.json, which sends the project's dependencies to the registry and reports known vulnerabilities; on BTP, deployed applications are the Application Vulnerability ReportApplication Vulnerability ReportA BTP service that tracks vulnerabilities in the open-source components of applications deployed in a BTP landscape, with an OData API for taking the report into ticketing systems.sap official, btp's.
Artifacts
Details
Coverage
For your agent
- Ref
capability:vulnerability-scanning- JSON
- /capabilities/vulnerability-scanning.json
- MCP
- Connecting an agent