Stop 12 · Security & Accessibility TestingTopics · 6/7

Vulnerability Scanning Basics

In short

Your app uses hundreds of open-source packages. When a security hole is found in one of them, you want to know the same day. Vulnerability scanners do that checking for you, automatically.

Automated tools that scan an application or its dependencies for known vulnerabilities — a lightweight, recurring check that QA can run as part of a broader quality gate.

The purple blob checks medicine boxes on a shelf against a clipboard list behind a chemist counter.

Think of it like this

The chemist's recall list

When a batch of medicine is recalled, a careful chemist checks every box on the shelf against the list and pulls the bad ones. A vulnerability scanner compares your packages against a public list of known problems.

Watch it happen

A dependency scan in the pipeline

CI job

Scanner

Advisory DB

Team

scan package-lock

1/5The CI job hands the scanner your exact list of packages and versions.

The big ideas

What you need to know

Dependency scans

Tools like npm audit, Dependabot or Snyk check your libraries against known vulnerability lists.

Image scans

Tools like Trivy check a Docker image's OS packages too, not just your code's libraries.

Running-app scans

OWASP ZAP can scan your running test site for issues like missing security headers.

Triage the noise

Not every finding matters. Check severity and whether the vulnerable code is actually used before panicking.

See it in code

Walk through the code

bash

1# Check npm dependencies against known advisories2npm audit --audit-level=high3 4# Scan a container image for known CVEs (Trivy, open source)5trivy image my-app:latest6 7# Passive baseline scan of YOUR test site with OWASP ZAP8docker run --rm -t ghcr.io/zaproxy/zaproxy:stable \9  zap-baseline.py -t https://staging.example.test

1/3Fails only when a high or critical advisory is found, so low-risk noise doesn't block builds.

Run the ZAP scan only against sites you own or have written permission to test. The baseline scan is passive and doesn't attack.

Save yourself the pain

Common mistakes

Oops

Running npm audit fix --force and shipping whatever it changed.

Do this instead

Force can jump major versions and break features. Upgrade, then run your test suite before merging.

Oops

Ignoring scan results because there are always some warnings.

Do this instead

Agree a rule, like 'high and critical block the build', and review the rest weekly.

Your mission

Scan your own project

~20 min

Quick check

npm audit reports a high-severity issue in a package your app depends on. What's the best first step?

Go deeper

1Run a free dependency vulnerability scanner against a sample project.
2Learn why keeping dependencies updated is a simple but frequently neglected practice.
3Understand this complements, but doesn't replace, dedicated application security testing.