---
updatedAt: 2026-08-17T08:11:10.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/security/llms.txt
---

# How-Tos

### **Software Composition Analysis (SCA)**

Each descriptor file (e.g., `pom.xml` for Maven, `go.mod` for Go) contains vulnerable dependencies.

1. Right-click a dependency to:
   * Jump to its declaration in the descriptor file.
   * Upgrade it to a fixed version (if available).
2. To view the details of a vulnerability, select one from the list.

Vulnerability details include:

* Vulnerable component information.
* Fixed versions.
* Impact paths and more.

**CVEs Contextual Analysis**

*Requires Xray 3.66.5+ and an Enterprise X/Enterprise+ subscription with Advanced DevSecOps.*

* Automatically validates high-impact vulnerabilities.
* Provides contextual analysis data, including:
  * **Status** – Indicates whether a CVE is applicable.
  * **Breakdown** – Explains why a CVE is applicable or not.
  * **Remediation** – Offers mitigation steps from JFrog's research team.

**Secrets Detection**

Detects secrets exposed in the code to prevent leaks of internal tokens or credentials.

*Requires Xray 3.66.5+ and an Enterprise X/Enterprise+ subscription with Advanced DevSecOps.*

1. To ignore detected secrets, add a comment above the line with the secret:

   ```plaintext
   // jfrog-ignore
   ```

**Infrastructure as Code (IaC) Scanning**

*Requires Xray 3.66.5+ and an Enterprise X/Enterprise+ subscription with Advanced DevSecOps.*

* Scans Terraform files for cloud and infrastructure misconfigurations.