---
id: 1800
title: "What does your code use, and is it vulnerable? It-depends!"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2021/12/16/it-depends/"
published_at: "2021-12-16T13:00:14Z"
tags: ["supply-chain", "open-source", "vulnerability-detection", "sbom", "dependency-analysis", "it-depends"]
phying_url: "https://phying.com/item/1800"
lang: en
---

# What does your code use, and is it vulnerable? It-depends!

## Summary

it-depends builds an SBOM for a source repository, covering cargo, npm, pip, Go, CMake, and autotools, and flags reachable CVEs by exploring every feasible dependency resolution.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2021-12-16T13:00:14Z
- **Original:** https://blog.trailofbits.com/2021/12/16/it-depends/
- **Phying News:** https://phying.com/item/1800