The safeguards map / 1.1 Code and dependencies
OWASP dep-scan
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A tool that scans local repositories and container images for dependencies with known vulnerabilities, with reachability analysis, and can write a CSAF VEX document.
Where it sits
1.1 Code and dependencies (primary): Scans application code, container images and Kubernetes manifests for known vulnerabilities in their dependencies, with prioritization and reachability analysis.
Scan most application code (local repos, Linux container images, Kubernetes manifests, and OS) to identify known CVEs with prioritization
captured
Perform advanced reachability analysis for multiple languages
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make it
- Runs
- in CIby hand
Handoffs
consumes Software and AI inventory: CycloneDX
produces Vulnerability status: CSAF VEX
Collector's note
The OWASP page lists the project as an Incubator project in the Other classification. The README also describes SBOM output with Vulnerability Disclosure Report information and a license-limits check, which the entry does not record.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.