scanner

README

Vulnerability scanner (preview)

This contains a vulnerability scanner written in Go.

This tool is currently under development and is subject to change.

Installing

$ go install github.com/google/osv.dev/tools/scanner@latest

Scanning an SBOM

SPDX and CycloneDX SBOMs using Package URLs are supported. The format is auto-detected based on the input file contents.

$ go run cmd/scanner.go /path/to/your/sbom.json

Scanning a directory

Given a list of directories, this tool will recursively search for git repositories and make requests to OSV to determine affected vulnerabilities.

This is intended to work with projects that use git submodules or a similar mechanism where dependencies are checked out as real git repositories.

Example

$ go run cmd/scanner.go /path/to/your/repo