SCA
Identifying third-party dependencies in a project and matching them against vulnerability and licence databases.
SCA reads manifests and lockfiles (or scans built artefacts), resolves the full transitive dependency tree, and matches each package and version against sources such as the GitHub Advisory Database, OSV and the NVD. Dependabot, Renovate, Snyk and Trivy are common examples.
Most code in a modern app is someone else's, so SCA usually finds more real issues than SAST. The noise problem is different: hundreds of CVEs in packages whose vulnerable function is never called. Reachability analysis, EPSS and KEV data, and VEX statements help prioritise.
SCA does not catch malicious packages that have no CVE yet (typosquatting, slopsquatting, compromised maintainers); that needs provenance checks, allow-lists and install-time controls.