See every open-source component — keep open source safe and compliant
A patented snippet-level engine builds complete, traceable SBOMs, maps multi-source vulnerability data, and governs license risk.
From component identification to compliance governance — across the full lifecycle of introduce, detect, fix, and manage.
A proprietary multi-dimensional probing technique analyzes programs quickly and accurately, with per-file scanning at microsecond scale.
Identifies open-source composition down to the code-snippet level, covering the full relationship of direct and transitive dependencies.
Outputs complete SBOMs in standard SPDX or CycloneDX, meeting NTIA minimum elements and boosting supply-chain transparency.
Maps against CVE, CNVD, CNNVD, EUVD, and CSSA, with customizable policy priority and granularity to fix the most critical issues first.
Pinpoints license conflicts and pairs SBOM data as structured evidence for compliance and legal defense, mitigating IP risk.
Extends beyond source into the container image layer, securing open-source components inside images.
Precise matching against a massive component corpus identifies copied, trimmed, or renamed open-source snippets — and surfaces license tampering.
Fingerprints functions/snippets — no reliance on declared package names.
Pinpoints the specific component and version.
Flags components with altered license or code.
Scanning produces a standardized software bill of materials (SPDX / CycloneDX), annotating each component with version, license, and known vulnerabilities.
One-click export to SPDX / CycloneDX.
Components, versions, licenses, and dependencies — complete.
CVE / CNVD mapped right onto the inventory.
CleanSource SCA's multi-source vulnerability mapping is powered by CSSA (CleanSource Security Advisory) — proactively sensing risk from upstream commits, maintainer discussions, security mailing lists, and package-registry behavior, so you assess exposure before a vulnerability becomes a public event.
Captures risk from upstream commits, maintainer discussions, and security mailing lists weeks ahead of public CVE / CNVD disclosure.
Flags supply-chain poisoning — malicious package injection, typosquatting, and maintainer account takeover — the moment it surfaces.
Extends vulnerability and poisoning intel into the MCP Server and AI Skills ecosystems, carrying coverage into the Agent era.
Built for OSPOs, individual developers, and small teams, CleanSource SCA CE opens its CLI and partial module source — ready on sign-up.
CleanSource SCA uses a patented snippet-level engine backed by 3T+ code fingerprints, 320M+ components and 270K+ vulnerability intelligence entries. It identifies copy-pasted, partially referenced and modified open-source code — far beyond manifest-only free tools in recall and precision.
It generates and exports standard SPDX and CycloneDX, meeting SBOM requirements under US EO 14028 and the EU Cyber Resilience Act.
CSSA is Sectrend's proprietary vulnerability-intelligence system aggregating CVE, CNVD, CNNVD and EUVD with proactive triage — alerting you weeks ahead of public CVEs.
Both SaaS and fully offline on-premises modes are available, meeting data-security requirements of state-owned enterprises and financial institutions.
Mainstream languages and 600+ package ecosystems (Maven, npm, PyPI, Go Modules and more), plus composition analysis for container images and other delivery artifacts.
The proprietary engine is built for very large repositories and supports incremental scanning — routine CI runs analyze only the diff, preserving snippet-level recall without slowing the pipeline.
Via CLI, API and integrations such as Jenkins and GitLab CI. Risk gates in the pipeline can automatically block builds that exceed thresholds, making open-source governance native to the dev process.
Book a demo and see how CleanSource SCA gives your supply chain a complete composition and compliance view.
