# Package Vulnerability Scanning

Package vulnerability scanning checks the third-party dependencies your application pulls in against known-vulnerability databases. It runs as a stage in your pipeline, so every build tells you whether the packages you’re shipping have reported security issues — before the build reaches an environment.

You’ll find the results on your [pipeline](https://salus.cloud/docs/pipelines/pipeline-details/) under its vulnerability report.

## Severity levels

Each finding is rated by severity so you can triage the important ones first:

| Severity | Meaning |
| --- | --- |
| **Critical** | Exploitable, high-impact issues — address immediately. |
| **High** | Serious issues that should be fixed promptly. |
| **Medium** | Moderate risk; plan a fix. |
| **Low** | Minor risk; fix as convenient. |

## What a finding tells you

Every finding identifies the vulnerability and the exact dependency it affects:

-   **Vulnerability ID**, title, and description of the issue.
-   **Severity** (see above).
-   **Affected package** — the package name, the version you currently have installed, and the package type (ecosystem) it comes from.
-   **Fixed versions** — the versions that resolve the vulnerability, so you know what to upgrade to.
-   **References** — links to the advisory or disclosure for more detail.

## Remediate a finding

The fastest fix is usually to upgrade the affected dependency to one of the **fixed versions** listed on the finding.

If [Salus Intelligence](https://salus.cloud/docs/salus-intelligence/) is enabled for your organization, it can go further: it reviews the vulnerable dependencies and can open a pull request with the proposed upgrade, so you review and merge instead of patching by hand.

## Block deployments on vulnerabilities

You don’t have to rely on people noticing a report. Add a [pipeline rule](https://salus.cloud/docs/pipelines/pipeline-customization/#pipeline-rules) so a build that fails the vulnerability check can’t be deployed — turning the scan into an enforced gate rather than an advisory.

Recommended

Gate on the vulnerability scanning stage so a build that fails it can’t reach production.

## Track how vulnerabilities change

Beyond a single build, Salus tracks how your dependency risk shifts between deployments — which vulnerabilities were newly **introduced**, which were **fixed**, and which were newly **disclosed** against packages you already run. This makes it easy to see whether a release is improving or regressing your security posture.