WhiteSource
Open-source security and license compliance company
WhiteSource, now operating as Mend, is a software composition analysis company that scans a codebase's open-source dependencies to identify known security vulnerabilities and license compliance risks. Its platform builds an inventory of…
Definition
WhiteSource, now operating as Mend, is a software composition analysis company that scans a codebase's open-source dependencies to identify known security vulnerabilities and license compliance risks. Its platform builds an inventory of every third-party library a project uses, cross-references that inventory against vulnerability databases, and flags problematic open-source licenses, helping engineering and security teams manage the risk that comes from relying on external code.
Overview
Modern applications are built on a deep stack of open-source dependencies, and each one introduces potential security and legal exposure that a development team did not write and may not fully audit. WhiteSource addressed this by focusing specifically on software composition analysis: rather than analyzing the code a team writes itself, it inventories every open-source component pulled into a build, however deeply nested, and evaluates each one for known vulnerabilities and license terms. Mechanically, WhiteSource's scanner integrates with build tools and package managers to construct a dependency tree, capturing both direct and transitive dependencies. It matches each component and version against vulnerability databases to flag known CVEs, and against a license classification database to identify components under licenses that may conflict with a company's usage policy, such as strong copyleft licenses that impose obligations on derivative works. Findings are prioritized by factors like whether a vulnerable function is actually reachable in the application's call graph, which helps teams triage which alerts represent real risk versus a vulnerability in unused code. WhiteSource sits within the software composition analysis category, distinct from static application security testing tools like SonarQube or CodeQL that analyze first-party code logic, and distinct from container image scanners that focus on OS-level packages inside a runtime image, although these categories are often used together as complementary layers of an application security program. Compared to tools that focus narrowly on vulnerability detection, WhiteSource's license compliance capability is a differentiator relevant to enterprises managing legal exposure from open-source usage at scale. In practice, security and legal teams use WhiteSource to maintain an approved list of licenses, automatically flag pull requests that introduce a disallowed license or a dependency with a known critical vulnerability, and generate reports for compliance audits or customer security questionnaires. Development teams get remediation guidance, such as the minimum version that resolves a known vulnerability, integrated into their existing pull request workflow. As with any vulnerability database-driven tool, WhiteSource's usefulness depends on database freshness and coverage; a newly disclosed vulnerability takes time to be cataloged and matched. License classification also requires ongoing maintenance as new open-source licenses and dual-licensing arrangements appear, and reachability analysis, while reducing noise, is not a substitute for reviewing genuinely exploitable findings closely before dismissing an alert. Organizations relying heavily on automated policy gates should also periodically audit false negatives, since a scanner tuned to reduce noise can occasionally suppress a finding that later turns out to matter in a specific deployment context.
Key Features
- Builds a full inventory of direct and transitive open-source dependencies
- Matches dependency versions against known vulnerability databases
- Flags open-source license terms that conflict with company policy
- Prioritizes findings using reachability analysis to reduce false urgency
- Integrates with build tools and package managers across many languages
- Generates compliance reports for audits and security questionnaires
- Provides remediation guidance including minimum safe upgrade versions
- Supports policy enforcement gates inside pull request workflows