dep-scan
dep-scan copied to clipboard
owasp-dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container ima...
### Request Description https://lyz-code.github.io/blue-book/gettext/ ### Additional Information _No response_
### Request Description https://github.com/oracle/graalpython ### Additional Information _No response_
- [x] Add a table of contents at the top of our ReadMe - [ ] Create a Read the Docs - [ ] Create documentation with sphinx - [...
https://github.com/DependencyTrack/dependency-track/discussions/3159#discussioncomment-7434198 Looks like depscan is not reporting vulnerabilities with the clojars type.
https://github.com/nexB/vulnerablecode/tree/main/vulntotal This way, we can compare and improve depscan where possible.
A tool like dep-scan inevitably produces false positives due to aliasing and SBoM generation lifecycle. While tools like trivy offer ignore files and rego policies to support advanced [filtering](https://github.com/aquasecurity/trivy/blob/v0.19.2/contrib/example_policy/advanced.rego), depscan...
It's time for depscan to inspect the executables bundled in the container image and system locations for anything malicious. The ticket would be updated to discuss the design of the...
Just according to the value of 'scope' (required, optional) in SBOM？ is that accurate？thanks ------------------ ``` if is_required and package_type not in config.OS_PKG_TYPES: package_usage = ":direct_hit: Direct usage" package_name_style =...
Linked issue: https://github.com/CycloneDX/cdxgen/issues/343 I want to replace the privado integration with [AppThreat atom](https://github.com/AppThreat/atom). Unlike Privado, which specializes in data privacy, atom would support more SBoM and Supply Chain use cases.
Metadata
Owner
Metadata
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container ima...