---
url: /en/security/sca-plugins.md
description: >
  Overview of CNB security scanner plugins — Open-Source Component Vulnerability
  Scan, License Scan, and SBOM Generation — three pipeline plugins that
  incrementally check dependency risks and changes during a Pull Request.
---
CNB provides three SCA pipeline plugins that compare Base and Head dependency changes in a Pull Request
and catch dependency risks before they merge: vulnerabilities, licenses, and the component inventory (SBOM).

:::: tip Difference from configuration-file scanning
[Code security scanning](./intro.md) is the platform's built-in, repository-level scan. Its scan scope can be adjusted
through `.scanignore` and `.cnb/security/code_scan_config.yml`; the SCA plugins are scan tasks declared explicitly
in the `pull_request` stage of `.cnb.yml`, run incrementally per PR, each with its own gate.
::::

## Plugin list

| Plugin | Image | Description |
|---|---|---|
| [Open-Source Component Vulnerability Scan](./sca-vulnerability.md) | `cnbcool/sca-vulnerability:latest` | Checks new dependency vulnerabilities in a PR; configurable gate |
| [License Scan](./sca-license.md) | `cnbcool/sca-license:latest` | Checks new License risks in a PR; configurable gate |
| [SBOM Generation](./sca-sbom.md) | `cnbcool/sca-sbom:latest` | Outputs the Base/Head component changes of a PR |

## Features

* **Incremental scanning**: scans PR Base and Head separately, processing only risks new to the current PR;
* **Gate**: the vulnerability and license plugins can fail the check by severity;
* **Standard SBOM**: the SBOM plugin supports JSON Delta, SPDX, CycloneDX, and SWID.

## Usage in CNB

Add the following configuration to the `.cnb.yml` at the root of your repository:

```yaml title=".cnb.yml"
main:
  pull_request:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
          settings:
            failOnSeverity: high

        - name: License Scan
          image: cnbcool/sca-license:latest
          settings:
            failOnSeverity: high

        - name: Generate SBOM Delta
          image: cnbcool/sca-sbom:latest
          settings:
            output: ${CNB_BUILD_WORKSPACE}/.cnb-sca/sbom-delta.json
```

## Gates

Set `failOnSeverity` for the vulnerability and License plugins to define the minimum severity
that blocks the check:

```yaml
failOnSeverity: high
```

With `high`, newly introduced High or Critical vulnerabilities and High License risks fail the check.
Omit this setting to report findings without applying a risk gate.

## Exit codes

| Exit code | Description |
|---:|---|
| `0` | Scan completed and no newly introduced risk matched the gate |
| `1` | A newly introduced risk matched the gate |
| `2` | Configuration error or scan failure |

## Next steps

* [Open-Source Component Vulnerability Scan](./sca-vulnerability.md) — vulnerability gate and incremental rules
* [License Scan](./sca-license.md) — License risk gate
* [SBOM Generation](./sca-sbom.md) — component change list and standard formats