The alert came in on a Tuesday morning.
A critical CVE. Severity score 9.8. Affecting one of the most widely used
open-source libraries in the Node.js ecosystem.
Our team had Snyk. We had Wiz. We had automated scanning pipelines and
weekly vulnerability reports. By most measures, we were well-equipped.
So when the question landed in the security channel —
"Where are we actually exposed in production right now?" —
we assumed the answer would take minutes.
It took most of the day.
That gap — between the tooling we had and the confidence we needed —
is exactly what this article is about.
The Core Problem
SCA tools like Snyk and Wiz are excellent at what they do.
They continuously scan repositories and flag vulnerable dependencies.
But they scan source code. Not production.
And in any sufficiently complex environment, those two things
can look very different:
- Deployments routinely lag behind the latest commit
- Dev dependencies appear in source but never reach runtime
- Inactive repos still show up in scans — inflating apparent exposure
- Different environments run different versions of the same service
The result? When a critical CVE drops, your SCA tool gives you
a list of repositories where the vulnerable library might exist.
What it cannot tell you is whether that library is actually deployed.
The Fix: A Runtime-First Approach
The most reliable source of truth isn't your source repository.
It's the code actually running in production.
For AWS Lambda, this is surprisingly practical. Lambda functions
contain their packaged dependencies — the actual node_modules
bundled at deployment time. Inspecting these directly gives you
immediate, high-confidence answers:
- Which functions are affected?
- Which version is running?
- Which environment?
No cross-team coordination. No waiting. No uncertainty.
What's in the Full Article
The complete research article covers:
- 📖 The real incident that revealed this gap
- 🔍 Why team-based verification fails under pressure
- 🧪 A practical runtime inspection workflow for AWS Lambda
- 🔄 How this pattern extends to containers and EC2
- 🏗️ Building this as a permanent MCP-powered capability
- 📊 How SCA and runtime inspection work together
Read the Full Article
This is a glimpse. The complete article — with detailed workflows,
diagrams, and implementation patterns — is published on Medium.
Top comments (0)