Socket SCA

Socket SCA reads your manifests and lockfiles, resolves the full dependency tree, and scores every package. Your source code is not uploaded. These pages take a proof of concept from a silent baseline across every repository to enforced pull request checks, reachability numbers, and fixes.

Start with the first page, then follow the goals that matter to you.

Get started

Goal	Page
Get every repository into Socket with no change developers can see	Connect your repositories
Scan repositories that aren't on GitHub, or gate a pipeline	Scan from CI/CD

Catch risky dependencies in pull requests

Goal	Page
Show a malicious dependency is caught in a pull request	Catch risky dependencies in pull requests
Decide what fails a pull request, and where	Tune policy and enforce
Flag or block by license	License policy

Cut CVE noise and fix what matters

Goal	Page
Measure how many CVEs can't be reached, across every repository	Cut CVE noise with reachability
Trace call paths from your own code on one or two apps	Full application reachability
Turn reachable CVEs into upgrade pull requests	Fix what matters
Remove CVEs that have no upgrade	Patch what you can't upgrade
Hand results to other tools	Export SBOM and VEX

Before you start

A Socket organization. Its slug is in the dashboard URL: https://socket.dev/dashboard/org/your-org.
Owner rights on the GitHub organization, to install the Socket GitHub App.
Node.js on your workstation, for the Socket CLI.
A Socket API token for the POC (Settings → API Tokens). Connect your repositories lists the scopes each page needs.