Open-source security tooling
Scan SBOMs without hiding uncertainty.
Simple Vulnerability Scanner matches CycloneDX and SPDX components against OSV, records exact input receipts, reconciles strict OpenVEX evidence, evaluates baselines and policy, and produces review-ready JSON, HTML, and SARIF reports.
CycloneDX + SPDXJSON component inventories
Complete OSV recordsPagination and detail enrichment
OpenVEX + policyExact matching and auditable gates
Python 3.10–3.12Offline tests in read-only CI
Real CLI run
From SBOM to three report formats
The capture below uses SVS v0.3.0 and the bundled CycloneDX sample. Advisory counts can change as OSV records evolve.
Captured 3 September 2026 from a successful scan.
Architecture
Completeness is a security property
SVS keeps skipped components visible, follows per-query OSV pagination, aborts incomplete enrichment, and recommends a fixed version only when the advisory data proves it.
Engineering notes