README
¶
ojo
ojo is an open source security scanner for dependencies, secrets, misconfiguration, and code — a single self-contained Go binary, no daemon, no local database to sync.
$ ojo fs . # dependency vulnerabilities in a repo
$ ojo image python:3.14-slim # OS package vulnerabilities in a container image
Installation
$ brew tap colibrisec/tap && brew install ojo # macOS
$ sudo apt install ./ojo_X.Y.Z_linux_amd64.deb # Debian/Ubuntu
$ sudo dnf install ojo_X.Y.Z_linux_amd64.rpm # Fedora/RHEL
$ sudo snap install ojo-scanner # Linux (Snap; command is ojo-scanner)
$ winget install colibrisec.ojo # Windows
$ docker run --rm ghcr.io/colibrisec/ojo:latest fs --help # Container
$ go install github.com/colibrisec/ojo@latest # go install
Prebuilt binaries (Linux/macOS/Windows, amd64+arm64) and checksums are on the Releases page. Full install instructions, including MSI/deb/rpm download URLs and Snap confinement caveats, are in docs/getting-started/installation.md.
Documentation
Full docs (installation, per-scanner guides, CLI reference, coverage matrix, and an honest list of current limitations) live in docs/, built with MkDocs Material — build and browse them locally:
$ pip install -r docs-requirements.txt
$ mkdocs serve
Scanners
| Scanner | What it finds | Runs by default |
|---|---|---|
| Vulnerability | Known CVEs in dependency manifests (ten ecosystems, see Coverage) and container OS packages (Alpine, Debian, Ubuntu), via OSV.dev | ✅ |
| Secret | Hardcoded credentials, API keys, tokens, private keys | Opt-in (--scanners secret) |
| Misconfiguration | Dockerfile / Kubernetes / Terraform security misconfigurations | Opt-in (--scanners misconfig) |
| SAST | Injection, weak crypto, and other source-level issues in Go (go/ast-based), Python, JavaScript/TypeScript, PHP, Ruby, and Java (tree-sitter-based) |
Opt-in (--scanners sast) |
Every command also supports -f sbom for a CycloneDX SBOM.
Building from source
Requires Go 1.22+.
$ git clone https://github.com/colibrisec/ojo.git && cd ojo
$ go build -o ojo .
Status
ojo is young — see Roadmap & Limitations for what isn't supported yet (rpm-based container images, dependency license scanning, and more).
License
Documentation
¶
There is no documentation for this package.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
cli
Package cli wires ojo's cobra commands.
|
Package cli wires ojo's cobra commands. |
|
image
Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning.
|
Package image scans a container image's OS package databases for vulnerable packages, producing model.Package values that feed the same OSV pipeline used for filesystem dependency scanning. |
|
manifest
Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists.
|
Package manifest discovers and parses dependency manifests/lockfiles into model.Package lists. |
|
misconfig
Package misconfig checks Dockerfiles, Kubernetes manifests, and Terraform for common security misconfigurations.
|
Package misconfig checks Dockerfiles, Kubernetes manifests, and Terraform for common security misconfigurations. |
|
model
Package model holds the core types shared across scan engines and reporters.
|
Package model holds the core types shared across scan engines and reporters. |
|
sast
Package sast statically analyzes source for common security anti-patterns: Go via the standard library's go/ast, Python via gotreesitter (a pure-Go, no-cgo tree-sitter runtime — see docs/guide/scanner/sast.md for why cgo was avoided) and its query engine.
|
Package sast statically analyzes source for common security anti-patterns: Go via the standard library's go/ast, Python via gotreesitter (a pure-Go, no-cgo tree-sitter runtime — see docs/guide/scanner/sast.md for why cgo was avoided) and its query engine. |