Learn English vocabulary for Software Composition Analysis (SCA): Snyk, FOSSA, Black Duck, open source license compliance, GPL copyleft, REUSE specification, and dependency graph scanning.
0 / 10 completed
1 / 10
SCA (Software Composition Analysis) tools like Snyk, FOSSA, and Black Duck primarily help organisations:
SCA tools scan your code and dependency manifests to build a component inventory, then cross-reference it against vulnerability databases (CVEs, OSS advisories) and a license database — giving security and legal teams visibility into risk.
2 / 10
'Copyleft' in open source licensing (e.g., GPL) means:
GPL copyleft is a 'viral' condition: if your product ships GPL-licensed code, your product's source must also be available under the GPL. This is a major concern for commercial software — SCA tools flag GPL components in products that are not open source.
3 / 10
A 'license risk' classification of 'high risk' for a dependency typically indicates:
SCA tools classify licences by business risk. Permissive licences (MIT, Apache 2.0) are low risk. Weak copyleft (LGPL) is medium risk. Strong copyleft (GPL, AGPL) is high risk for proprietary products because shipping GPL code can require open-sourcing your entire product.
Dependabot monitors your dependency manifests and lockfiles. When a vulnerability is published for a package you use, it opens a PR with the patched version. It also opens PRs for regular version updates if configured, keeping the dependency tree current.
5 / 10
The REUSE specification (from the FSFE) addresses open source compliance by requiring:
REUSE defines that every file should have copyright and SPDX licence headers, and full licence texts live in a LICENSES/ folder. A reuse lint tool validates compliance. This makes SCA tools' work reliable — they can definitively identify the licence of every file, not just the package as a whole.
6 / 10
Review Comment: 'I'm seeing a high license risk score on the lodash dependency. Sarah, can you explain why this is flagged as 'high' and what we should do?'
The 'high' score in SCA tools doesn't necessarily mean a problem. It signifies that the dependency has licenses with clauses (like copyleft) that could trigger obligations if the software is used commercially. Understanding these implications is crucial for compliance and risk mitigation – simply dismissing it as an 'inaccurate scare' would be irresponsible.
7 / 10
Slack Message: 'Hey team, I'm running a SCA scan on the new microservice. Initial results show several components with 'copyleft' licenses – specifically GPLv3. Does anyone have experience navigating these and ensuring we're compliant?'
'Copyleft' isn't about making everything open source. It's a family of licenses that require derivative works to also be licensed under the same terms (often with attribution). The crucial aspect is understanding *which* copyleft license is being used – GPLv3, for example, has stricter requirements than some others.
8 / 10
PR Description: 'Adding a new dependency: 'requests'. SCA scan identified a potential license risk – specifically, the MIT license. I've reviewed the license terms and confirmed we can use 'requests' in our commercial application without modification.'
'MIT' is a very permissive open-source license. It grants developers broad rights to use, modify, and distribute the software, including in commercial applications, without requiring source code release (although attribution is typically expected). The term 'potential' indicates that this specific risk has been assessed and deemed acceptable based on the license terms.
9 / 10
API Response: (Snyk API response snippet) {
"dependency": "jquery",
"license": "MIT",
"risk_score": 25,
"risk_description": "Low risk. MIT license allows commercial use."
}
The API response provides a structured view of the SCA tool's analysis. A 'low' risk score combined with a 'MIT' license indicates that the dependency is generally safe for commercial use, but it doesn't eliminate the need for ongoing monitoring and security best practices. The 25 score reflects the level of potential concern, not necessarily an imminent threat.
10 / 10
Standup Update: 'I've been running Snyk on our new backend. We're using the REUSE specification to ensure all our open source components comply with their respective licenses – particularly focusing on ensuring we don't inadvertently violate copyleft terms.'
The REUSE specification (from the FSFE) is a critical standard for managing open source licenses. It's *not* just about vulnerability scanning; it's specifically designed to enforce compliance by providing a standardized way to understand and manage license obligations – particularly copyleft restrictions - across an organization's dependencies.
What will I learn from the "Software Composition Analysis Vocabulary" exercise?
Learn English vocabulary for Software Composition Analysis (SCA): Snyk, FOSSA, Black Duck, open source license compliance, GPL copyleft, REUSE specification, and dependency graph scanning.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.