Scan Depth: Deep Dependency Analysis One Hundred Layers Down

AdvancedFree5 modules · 15 lessons · ~2 min

About this course

An advanced course for Application Security (AppSec) practitioners on why transitive dependency depth, not the short list of packages a team chose directly, carries most of a real application's supply chain risk. You will learn how lockfile resolution differs across ecosystems, how to read and triage a dependency graph many layers deep, how Reachability Analysis keeps deep scanning actionable rather than noisy, where vendored, shaded and minified code break the graph entirely, and how to set Scanner Settings depth controls deliberately per asset criticality.

What you'll learn

Direct, Transitive and the Shape of Real Risk

Direct versus Transitive Dependencies: Why the Tail Dominates Real Risk
How Lockfiles and Manifests Resolve, Ecosystem by Ecosystem
Where Resolution Goes Wrong: Ranges, Overrides and Phantom Versions

Depth as a Dial

What Changes in the Results as Depth Increases
The Cost Curve of Depth: Time, Compute and Noise
Scanner Settings: Default Scan Mode, Per-Scanner Scan Depth and Matching Depth to Asset Criticality

Reading the Graph and Finding What Matters

Reading a Dependency Graph One Hundred Layers Down
Finding the One Path That Matters: Triage on a Deep Graph
Reachability Analysis: The Counterweight That Keeps Deep Scanning Actionable

01Direct, Transitive and the Shape of Real Risk3 lessons

Direct versus Transitive Dependencies: Why the Tail Dominates Real Risk
How Lockfiles and Manifests Resolve, Ecosystem by Ecosystem
Where Resolution Goes Wrong: Ranges, Overrides and Phantom Versions

02Depth as a Dial3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Where the Graph Breaks

Vendored and Bundled Code: When the Manifest Does Not Tell the Whole Story
Shaded and Relocated Packages: Losing Identity on Purpose
Minified and Obfuscated Code: When the Graph Has No Edges Left to Read

Worked Examples and Operating Discipline

Worked Example: A Shallow Scan Reports Clean, a Deep Scan Finds a Real Exposure
Worked Example: The Malicious Package Six Layers Down
Building and Maintaining a Depth Policy With Continuous Scanning

What Changes in the Results as Depth Increases

The Cost Curve of Depth: Time, Compute and Noise

Scanner Settings: Default Scan Mode, Per-Scanner Scan Depth and Matching Depth to Asset Criticality

03Reading the Graph and Finding What Matters3 lessons

Reading a Dependency Graph One Hundred Layers Down
Finding the One Path That Matters: Triage on a Deep Graph
Reachability Analysis: The Counterweight That Keeps Deep Scanning Actionable

04Where the Graph Breaks3 lessons

Vendored and Bundled Code: When the Manifest Does Not Tell the Whole Story
Shaded and Relocated Packages: Losing Identity on Purpose
Minified and Obfuscated Code: When the Graph Has No Edges Left to Read

05Worked Examples and Operating Discipline3 lessons

Worked Example: A Shallow Scan Reports Clean, a Deep Scan Finds a Real Exposure
Worked Example: The Malicious Package Six Layers Down
Building and Maintaining a Depth Policy With Continuous Scanning2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.