DevSecOps in Practice: Tools That Actually Catch Vulnerabilities - Part 3 - SCA with pip-audit

Parts 1 and 2 covered the code you write — secrets and static vulnerabilities in app.py . But modern applications are mostly made up of code you didn't write. Every package in requirements.txt is someone else's code running in your app. If any of those packages have known vulnerabilities, your app inherits them. That's what SCA is for. Code repo: https://github.com/pkkht/devsecops-demo/ What SCA is SCA stands for Software Composition Analysis. It looks at your dependency list, checks each packag