Allow and deny lists for dependencies

Allow and deny lists

Allow and deny lists help you control which dependencies your organization accepts or blocks. Fortify SCA and Open Source Select use these lists in automation rules to evaluate dependencies by name, version, or package URL.

Use allow lists to approve known-good components. Use deny lists to block components that your organization does not allow.

How allow and deny lists work

Allow and deny lists contain dependency entries. Automation rules evaluate dependencies against those entries and apply the configured action.

List entries do not trigger actions by themselves. You must reference the lists from an automation rule for the lists to take effect.

Supported dependency formats

You can define dependency entries in these formats:

Format	Example	Match behavior
PURL	pkg:npm/lodash@4.17.21	Matches one exact package and version
Name only	lodash	Matches all versions and package managers for that dependency name
Name and version	lodash@4.17.21	Matches one exact name and version
Name and version range	lodash@>=4.0.0	Matches versions that fall within the range

Use PURL when you want exact package matching across ecosystems. Use name-based entries when you want broader policy coverage.

Use cases

This feature supports these governance workflows:

• Block specific components that your organization does not allow.

• Require vetted open-source dependencies in conservative environments.

• Sync component approval data from external systems.

• Reduce rule duplication by managing many components in shared lists.