- Home
- Software Composition Analysis Software
- OWASP dep-scan
On the recordRead 7 Oct 202614 facts
OWASP dep-scan
Plans and prices
OWASP dep-scan
Free
Fully open source · server mode and some extensions require the all package
Read 7 Oct 2026 · owasp.org
On the record
- Inputs
- Supports local repositories, Linux container images, Kubernetes manifests, and operating systems.owasp.github.io · read 7 Oct 2026
- Integrations
- Uses CycloneDX cdxgen to create SBOMs and documents integration with ORAS CLI and CI environments.owasp.org · read 7 Oct 2026
- License and audience
- The repository identifies the project as MIT licensed and describes it for dependency and container-image security and license audits.github.com · read 7 Oct 2026
- Local scanning
- Package vulnerability scanning runs locally, and the project says it does not require a server for that mode.owasp.github.io · read 7 Oct 2026
- Notable limitation
- The documented package risk audit mode currently supports npm and PyPI packages only.owasp.github.io · read 7 Oct 2026
- Prioritization
- Identifies known CVEs with prioritization to help users focus on findings that need attention.github.com · read 7 Oct 2026
- Purpose
- Audits project dependencies, container images, and operating systems for known vulnerabilities, advisories, and license limitations.owasp.github.io · read 7 Oct 2026
- Reachability
- Provides reachability analysis across Java, JavaScript/TypeScript, Python, PHP, Rust, Go, and .NET.github.com · read 7 Oct 2026
- Reports
- Can generate SBOMs with Vulnerability Disclosure Report information and CSAF 2.0/2.1 VEX documents.github.com · read 7 Oct 2026
- Server and API
- Can run as a self-hosted server with a /scan endpoint for scanning directories, SBOM files, and GitHub repositories.github.com · read 7 Oct 2026
- Server security
- The server refuses non-local binding unless an API key is configured or unauthenticated binding is explicitly enabled.github.com · read 7 Oct 2026
- Support
- The project says developers can be reached through its Discord channel.owasp.org · read 7 Oct 2026
- Vulnerability data
- Lists OSV, NVD, GitHub, NPM, and Linux vulnerability data among its sources.owasp.github.io · read 7 Oct 2026
