Dependency Scanning on Mobile

Instructions

Most reported mobile CVEs live in dependencies — third-party SDKs, networking libs, image loaders, JSON parsers. A weekly cadence beats a one-off audit.

1. Inventory First

You can't scan what you can't see. Produce an SBOM per build:

• Android: CycloneDX Gradle plugin (org.cyclonedx.bom) produces bom.json.
• iOS: cyclonedx-cocoapods / cyclonedx-swift for SwiftPM.
• Flutter: cyclonedx_dart or parse pubspec.lock.
• React Native: @cyclonedx/cdxgen handles npm + native.

Archive the SBOM with the release artifact. You will want it the day a new CVE drops.

2. Gradle / Android