Mend SCA

Mend SCA (formerly WhiteSource) is an industry-leading Software Composition Analysis (SCA) platform engineered to help software engineering, security, and compliance teams automatically detect, prioritize, and remediate open-source security vulnerabilities and open-source software license risks across the entire software development lifecycle. By integrating scanning directly into developer pipelines, Mend SCA protects modern software supply chains.

The platform integrates natively into source code repositories, developer IDEs, package managers, and CI/CD pipelines across over 200 programming languages and package formats. Key platform capabilities include automated detection of vulnerable direct and transitive open-source dependencies, automated remediation advice that generates pull requests with non-breaking updates, automated open-source license risk classification, full Software Bill of Materials (SBOM) generation, and patented patented vulnerability prioritization technology that evaluates whether vulnerable code is actually called by the application.

Global enterprises, fintech leaders, and healthcare technology companies deploy Mend SCA to secure their third-party code dependencies without degrading engineering velocity. It integrates smoothly with GitHub, GitLab, Bitbucket, Jira, and Jenkins. Primary operational use cases include preventing vulnerable open-source libraries from being introduced into production builds, automating compliance with open-source licenses (such as GPL and AGPL), discovering newly disclosed zero-day vulnerabilities in deployed applications, and maintaining complete software supply chain governance.