Product · Supply chain security
Dependency security for large Gradle projects
One vulnerable package can affect hundreds of modules. RingZero's software composition analysis (SCA) finds vulnerable dependencies and shows where they enter your build, so teams can investigate the right declaration first.
Keep a complex build in one scan
Scan a whole Gradle monorepo or individual modules. Large uploads are split automatically, with findings and dependency evidence loaded as you need them. Search modules and filter by team without breaking the repository into separate scans. Shared vulnerabilities count once in the scan's totals.
See the large-project guide for setup, local reports, and operating limits.
See where a fix belongs and who else is affected
If a shared module brings in a vulnerable library, its consumers inherit the risk. Switch between the modules that introduce a dependency and all modules affected by it. Open the dependency path for evidence, including packages pulled in indirectly.
See an attribution example or learn how to review findings.
Keep the context your teams use
Attach a team name and custom labels such as service, domain, or cost center to each module. Review that context alongside its dependencies, with team and module filters to narrow the findings. Each module keeps its own labels, even in an aggregate scan.
Configure module teams and labels.
Start with your existing build
- Gradle: Java/Kotlin builds, large monorepos, module/team attribution, and configuration cache support.
- JavaScript / TypeScript: npm CLI for package-lock.json, including workspaces. The npm CLI does not yet include module ownership.
- Python and custom tooling: upload resolved dependency graphs through the REST API.
Findings show advisory severity, installed and fixed versions when available, and dependency paths. Paths explain build relationships; runtime reachability, AI penetration testing, and automated fixes are planned. For AI agent tooling checks available today, explore MCP security.
Frequently asked questions
Can RingZero scan a large Gradle monorepo?
Yes. The plugin uploads large builds in parts while keeping one scan. Findings, modules, and dependency paths load as you need them. There is no repository-wide module-count ceiling in this upload mode; individual graph complexity and resource budgets still apply.
Can I use my own teams and custom labels?
Yes. Set a team name and custom labels such as service, domain, or cost center on each module. Filter findings by team or module and inspect custom labels in module details. Labels do not automatically assign people or change access permissions.
Can I inspect dependencies without an account?
Yes. Gradle and npm can write local dependency reports without an API key. Upload a scan to match versions against vulnerability advisories. Large Gradle reports are a bundle of files; keep the whole report directory.
Will vulnerabilities fail my CI build?
Not yet. The Gradle scan task returns after its upload is accepted; findings appear after processing. Vulnerability policy gates and automated fixes are planned. Resolution or upload errors can still fail the task.