Package Vulnerability Scanning
Package vulnerability scanning checks the third-party dependencies your application pulls in against known-vulnerability databases. It runs as a stage in your pipeline, so every build tells you whether the packages you’re shipping have reported security issues — before the build reaches an environment.
You’ll find the results on your pipeline under its vulnerability report.
Severity levels
Each finding is rated by severity so you can triage the important ones first:
| Severity | Meaning |
|---|---|
| Critical | Exploitable, high-impact issues — address immediately. |
| High | Serious issues that should be fixed promptly. |
| Medium | Moderate risk; plan a fix. |
| Low | Minor risk; fix as convenient. |
What a finding tells you
Every finding identifies the vulnerability and the exact dependency it affects:
- Vulnerability ID, title, and description of the issue.
- Severity (see above).
- Affected package — the package name, the version you currently have installed, and the package type (ecosystem) it comes from.
- Fixed versions — the versions that resolve the vulnerability, so you know what to upgrade to.
- References — links to the advisory or disclosure for more detail.
Remediate a finding
The fastest fix is usually to upgrade the affected dependency to one of the fixed versions listed on the finding.
If Salus Intelligence is enabled for your organization, it can go further: it reviews the vulnerable dependencies and can open a pull request with the proposed upgrade, so you review and merge instead of patching by hand.
Block deployments on vulnerabilities
You don’t have to rely on people noticing a report. Add a pipeline rule so a build that fails the vulnerability check can’t be deployed — turning the scan into an enforced gate rather than an advisory.
Track how vulnerabilities change
Beyond a single build, Salus tracks how your dependency risk shifts between deployments — which vulnerabilities were newly introduced, which were fixed, and which were newly disclosed against packages you already run. This makes it easy to see whether a release is improving or regressing your security posture.