README
¶
ojo
ojo is an open source security scanner for dependencies, secrets, misconfiguration, and code — a single self-contained Go binary, no daemon, no local database to sync.
$ ojo fs . # dependency vulnerabilities + secrets in a repo
$ ojo image python:3.14-slim # OS package vulnerabilities in a container image
Documentation
Full docs (installation, per-scanner guides, CLI reference, coverage matrix, and an honest list of current limitations) live in docs/, built with MkDocs Material — build and browse them locally:
$ pip install -r docs-requirements.txt
$ mkdocs serve
Scanners
| Scanner | What it finds | Runs by default |
|---|---|---|
| Vulnerability | Known CVEs in dependency manifests (Go, npm, PyPI) and container OS packages (Alpine, Debian, Ubuntu), via OSV.dev | ✅ |
| Secret | Hardcoded credentials, API keys, tokens, private keys | ✅ |
| Misconfiguration | Dockerfile / Kubernetes / Terraform security misconfigurations | Opt-in (--scanners misconfig) |
| SAST | Injection, weak crypto, and other source-level issues in Go (go/ast-based), Python, JavaScript/TypeScript, PHP, Ruby, and Java (tree-sitter-based) |
Opt-in (--scanners sast) |
Every command also supports -f sbom for a CycloneDX SBOM.
Building from source
Requires Go 1.22+.
$ go build -o ojo .
Status
ojo is young — see Roadmap & Limitations for what isn't supported yet (rpm-based images, non-Go SAST, license scanning, and more).
License
Documentation
¶
There is no documentation for this package.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
cli
Package cli wires ojo's cobra commands.
|
Package cli wires ojo's cobra commands. |
|
image
Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning.
|
Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning. |
|
manifest
Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists.
|
Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists. |
|
misconfig
Package misconfig checks Dockerfiles, Kubernetes manifests, and Terraform for common security misconfigurations.
|
Package misconfig checks Dockerfiles, Kubernetes manifests, and Terraform for common security misconfigurations. |
|
model
Package model holds the core types shared across scan engines and reporters.
|
Package model holds the core types shared across scan engines and reporters. |
|
osv
Package osv queries the OSV.dev vulnerability database (https://osv.dev) for known advisories affecting a set of packages.
|
Package osv queries the OSV.dev vulnerability database (https://osv.dev) for known advisories affecting a set of packages. |
|
report
Package report renders scan findings as a table, JSON, or CycloneDX SBOM.
|
Package report renders scan findings as a table, JSON, or CycloneDX SBOM. |
|
sast
Java rules, using gotreesitter's java grammar — same pure-Go, no-cgo tree-sitter runtime already used for Python/JS/PHP/Ruby (see python.go's package doc).
|
Java rules, using gotreesitter's java grammar — same pure-Go, no-cgo tree-sitter runtime already used for Python/JS/PHP/Ruby (see python.go's package doc). |
|
secret
Package secret scans source files for hardcoded credentials using a regex + keyword + entropy rule set (see default_rules.yaml).
|
Package secret scans source files for hardcoded credentials using a regex + keyword + entropy rule set (see default_rules.yaml). |
|
walk
Package walk provides the directory traversal shared by every filesystem-based scanner.
|
Package walk provides the directory traversal shared by every filesystem-based scanner. |
Click to show internal directories.
Click to hide internal directories.