🔍 Dependency Scanning Strategy¶

🛠️ Herramientas¶

╔═══════════════════════════════════════════════════════════╗ ║ Tool │ Qué detecta │ Cuándo corre ║ ╠═════════════╪══════════════════════╪════════════════════╣ ║ Snyk │ CVEs, licenses │ PR + daily ║ ║ Dependabot │ Outdated deps │ Weekly ║ ║ npm audit │ npm vulnerabilities │ Pre-commit ║ ║ OWASP Dep │ Java/.NET CVEs │ CI build ║ ╚═══════════════════════════════════════════════════════════╝

🎯 Severity Thresholds¶

Critical: Block merge, fix < 24h High: Block merge, fix < 1 week Medium: Warning, fix < 1 month Low: Info, fix when convenient

📋 Response Process¶

Alert triggered
Automated notification sent to security channel
Create tracking ticket automatically
Review vulnerability details
Check CVE database for details
Assess actual impact on our codebase
Determine exploitability in our context
If false positive → Document exemption
Add to EXEMPTIONS.md
Update scanner config to ignore
Require security lead approval
If real → Patch or mitigate
Update dependency if patch available
Apply workaround if no patch exists
Remove dependency if not critical
Verify fix
Re-run scanner
Test application functionality
Review for side effects
Close ticket
Document resolution
Update runbooks if needed
Schedule follow-up review

🔄 Continuous Monitoring¶

Daily Scans¶

Run Snyk on main branch
Alert on new Critical/High findings
Auto-create tickets for new issues

Weekly Scans¶

Dependabot checks for updates
License compliance scan
Generate weekly report

Monthly Review¶

Review all open vulnerabilities
Re-assess exemptions
Update scanning policies
Review false positive rate

📊 Metrics to Track¶

Mean time to remediate (MTTR) by severity
Number of vulnerabilities introduced
False positive rate
Dependency freshness score
License compliance violations