Weekly supply-chain report for open-source security tools
Every week, each of the 78 active tools in the Awesome Security Pipeline catalog is scanned at its latest release: its dependencies and known vulnerabilities, which vulnerable code actually ships in its binary, whether the release can be verified, how its repository and CI are secured, and what changed since the previous week.
78
projects scanned, 22266 declared dependencies
144 / 890
critical / high matches in 52 projects (376 distinct advisories; 2145 matches of any severity)
119
advisories with vulnerable code shipped in a release binary, across 31 of 37 analyzed Go tools
24 / 49
Linux releases verifiable by signature, provenance, or attestation
6.5
median OpenSSF Scorecard (58 scored)
This week
OpenSSF Scorecard changed (1)
- opa: 8 → 8.2
All projects
Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. Rows marked on the left changed since last week. Select a project for its full inventory, advisories, and history.
| Project | Version scanned | Dependencies | Critical | High | Medium | Low | Unknown | Vulnerable packages | Fixable | KEV | In binary | Scorecard | Workflow | Release | Change since last week |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| safe-chain Software Composition Analysis (SCA) | 1.5.27 | 7 | 0 | 1 | 0 | 0 | 0 | 1 | 1 | — | — | 4.5 | 18 | verified | no change |
| njsscan Static Application Security Testing (SAST) › Language-specific › JavaScript/Node.js | 1.0.2 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 5.5 | 0 | no release files | first scan |
| grype Software Composition Analysis (SCA) | v0.121.0 | 375 | 0 | 4 | 2 | 0 | 3 | 4 | 3 | — | 21 | 7.9 | 0 | verified | no change |
| syft SBOM Generation | v1.55.0 | 382 | 0 | 20 | 24 | 2 | 3 | 10 | 48 | — | 16 | 8.7 | 0 | verified | no change |
| kube-bench Kubernetes Security | v0.16.0 | 101 | 1 | 5 | 0 | 0 | 2 | 2 | 8 | — | 29 | 5.8 | 1 | checksums only | no change |
| tracee Container Security › Runtime Security | v0.24.1 | 194 | 12 | 34 | 30 | 3 | 5 | 14 | 74 | — | 57 | 7.0 | 16 | checksums only | no change |
| trivy Software Composition Analysis (SCA) | v0.76.1 | 509 | 0 | 4 | 3 | 0 | 3 | 5 | 3 | — | 3 | 7.1 | 1 | verified | no change |
| trivy-operator Kubernetes Security | v0.36.1 | 425 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | — | 1 | 7.5 | 1 | verified | no change |
| Dark-Moon API & Dynamic Testing (DAST) | v1.6.0 | 0 | no dependencies found to match | 0 | 0 | — | — | 3.8 | 0 | no release files | no change | ||||
| cfn-lint Infrastructure as Code Security | v1.59.0 | 7 | 1 | 0 | 0 | 1 | 0 | 1 | 2 | — | — | 6.0 | 28 | no Linux binary | no change |
| bearer Static Application Security Testing (SAST) › Multi-language | v2.1.3 | 146 | 0 | 0 | 1 | 0 | 3 | 3 | 3 | — | 2 | 6.3 | 6 | checksums only | no change |
| sealed-secrets Secret Management | v0.41.2 | 102 | 0 | 0 | 0 | 0 | 3 | 2 | 2 | — | 0 | 6.8 | 5 | signed, signer not checked | no change |
| checkov Infrastructure as Code Security | 3.4.0 | 133 | 3 | 49 | 32 | 6 | 0 | 14 | 89 | — | — | — | 10 | no checksums or signatures | no change |
| kics Infrastructure as Code Security | v2.2.0 | 373 | 4 | 8 | 7 | 4 | 3 | 10 | 21 | — | — | — | 0 | no release files | no change |
| tetragon Container Security › Runtime Security | v1.8.0 | 220 | 0 | 3 | 2 | 0 | 0 | 1 | 0 | — | 0 | — | 33 | no checksums or signatures | no change |
| cloudquery Cloud Security | cli-v6.49.2 | 975 | 3 | 32 | 27 | 5 | 6 | 25 | 65 | — | 8 | 6.0 | 14 | checksums only | no change |
| cdxgen SBOM Generation | v13.6.0 | 329 | 1 | 4 | 6 | 2 | 0 | 8 | 13 | — | — | — | 1 | checksums only | no change |
| cyclonedx-cli SBOM Generation | v0.33.1 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 21 | no checksums or signatures | no change |
| dependency-track Software Composition Analysis (SCA) | 5.2.1 | 212 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 7.5 | 0 | no Linux binary | no change |
| bomber Software Composition Analysis (SCA) | v0.5.1 | 44 | 1 | 13 | 10 | 1 | 2 | 5 | 27 | — | 83 | — | 7 | checksums only | no change |
| docker-bench-security Container Security › Image Scanning | v1.6.1 | 6 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.7 | 1 | no Linux binary | no change |
| sysdig-inspect Container Security › Runtime Security | 0.12.1 | 665 | 10 | 60 | 31 | 17 | 0 | 57 | 118 | — | — | — | 17 | no Linux binary | first scan |
| eslint-plugin-security Static Application Security Testing (SAST) › Language-specific › JavaScript/Node.js | eslint-plugin-security-v4.2.1 | 7 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 9 | no release files | no change |
| external-secrets Secret Management | v2.14.0 | 529 | 1 | 5 | 2 | 2 | 3 | 8 | 12 | — | — | 8.3 | 16 | no Linux binary | no change |
| polaris Kubernetes Security | v10.2.5 | 81 | 1 | 5 | 0 | 0 | 2 | 2 | 8 | — | 16 | 5.1 | 5 | signed, signer not checked | no change |
| falco Container Security › Runtime Security | 0.45.2 | 42 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 7.5 | 106 | no checksums or signatures | no change |
| sops Secret Management | v3.13.3 | 207 | 1 | 11 | 3 | 1 | 3 | 6 | 18 | — | 31 | — | 3 | verified | no change |
| codeql Static Application Security Testing (SAST) › Multi-language | main (branch) | 543 | 2 | 21 | 30 | 1 | 4 | 10 | 58 | — | — | 5.8 | 165 | — | no change |
| gitleaks Pre-commit & Secrets Detection | v8.30.1 | 83 | 7 | 9 | 8 | 1 | 1 | 6 | 25 | — | 70 | — | 5 | checksums only | no change |
| govulncheck Static Application Security Testing (SAST) › Language-specific › Go | v1.1.4 | 8 | 0 | 2 | 0 | 1 | 0 | 2 | 3 | — | — | 3.7 | 0 | no release files | no change |
| dockle Container Security › Image Scanning | v0.4.15 | 101 | 9 | 18 | 12 | 2 | 1 | 11 | 35 | — | 76 | 4.1 | 8 | checksums only | no change |
| osv-scanner Software Composition Analysis (SCA) | v2.7.0 | 238 | 0 | 0 | 0 | 0 | 3 | 2 | 2 | — | 16 | 8.6 | 5 | verified | no change |
| hadolint Container Security › Image Scanning | v2.15.1 | 17 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.7 | 47 | verified | no change |
| vault Secret Management | v2.2.1 | 651 | 0 | 12 | 9 | 0 | 4 | 8 | 19 | — | — | 6.5 | 205 | no release files | no change |
| in-toto Supply Chain Compliance | v3.1.0 | 22 | 1 | 3 | 1 | 0 | 0 | 2 | 5 | — | — | 6.5 | 4 | no Linux binary | no change |
| infisical Secret Management | v0.167.4 | 2041 | 5 | 103 | 130 | 26 | 6 | 67 | 261 | — | — | 6.9 | 24 | no release files | no change |
| kubescape Kubernetes Security | v4.0.17 | 644 | 1 | 9 | 5 | 0 | 4 | 7 | 11 | — | 12 | 7.6 | 1 | verified | no change |
| KubeStellar Console Kubernetes Security | v0.3.42 | 606 | 4 | 26 | 28 | 12 | 2 | 20 | 71 | — | 16 | — | 19 | verified | no change |
| kyverno Kubernetes Security | v1.19.2 | 491 | 0 | 2 | 3 | 3 | 4 | 9 | 10 | — | 6 | 7.8 | 54 | verified | no change |
| cartography Cloud Security | 0.144.0 | 262 | 0 | 6 | 11 | 5 | 0 | 5 | 22 | — | — | 8.1 | 0 | no release files | no change |
| sbom-tool SBOM Generation | v4.1.5 | 9 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 2 | no checksums or signatures | no change |
| notation Artifact Signing & Verification | v1.3.2 | 38 | 7 | 11 | 10 | 2 | 1 | 5 | 30 | — | 92 | 6.5 | 1 | checksums only | no change |
| conftest Policy as Code | v0.71.1 | 181 | 1 | 5 | 2 | 0 | 3 | 3 | 10 | — | 16 | 7.2 | 0 | verified | no change |
| gatekeeper Policy as Code | v3.23.1 | 1296 | 4 | 84 | 50 | 17 | 3 | 55 | 155 | — | 44 | — | 4 | verified | no change |
| opa Policy as Code | v1.22.0 | 156 | 0 | 2 | 0 | 0 | 3 | 3 | 4 | — | 0 | 8.2 | 1 | verified | Scorecard 8 → 8.2 |
| scorecard Supply Chain Compliance | v5.6.0 | 694 | 1 | 5 | 2 | 0 | 6 | 5 | 12 | — | 4 | 8.6 | 4 | verified | no change |
| phpstan Static Application Security Testing (SAST) › Language-specific › PHP | 2.3.4 | 335 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.8 | 4 | no Linux binary | no change |
| pre-commit Pre-commit & Secrets Detection | v4.7.0 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.5 | 9 | no Linux binary | no change |
| brakeman Static Application Security Testing (SAST) › Language-specific › Ruby | v8.1.0 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.0 | 5 | no release files | no change |
| nuclei API & Dynamic Testing (DAST) | v3.11.1 | 441 | 1 | 19 | 7 | 0 | 3 | 9 | 29 | — | 35 | 6.8 | 76 | checksums only | no change |
| prowler Cloud Security | 5.47.0 | 2034 | 1 | 22 | 55 | 9 | 0 | 47 | 87 | — | — | — | 1 | no release files | no change |
| bandit Static Application Security Testing (SAST) › Language-specific › Python | 1.9.4 | 8 | 1 | 0 | 0 | 1 | 0 | 1 | 2 | — | — | 5.8 | 14 | no release files | no change |
| safety Static Application Security Testing (SAST) › Language-specific › Python | 3.8.1 | 17 | 1 | 1 | 0 | 1 | 0 | 2 | 3 | — | — | 4.7 | 46 | no checksums or signatures | no change |
| clair Container Security › Image Scanning | v4.9.0 | 128 | 14 | 34 | 17 | 6 | 3 | 20 | 67 | — | 82 | 5.0 | 69 | no checksums or signatures | no change |
| sbomlyze SBOM Generation | v0.6.0 | 42 | 0 | 1 | 0 | 0 | 0 | 1 | 1 | — | 0 | 7.9 | 4 | verified | no change |
| cargo-audit Static Application Security Testing (SAST) › Language-specific › Rust | cargo-audit/v0.22.2 | 465 | 0 | 1 | 3 | 2 | 0 | 3 | 6 | — | — | — | 2 | no checksums or signatures | no change |
| vet Software Composition Analysis (SCA) | v1.20.0 | 712 | 4 | 41 | 35 | 1 | 3 | 24 | 71 | — | 58 | 7.4 | 5 | verified | no change |
| cloudsplaining Cloud Security | 0.9.1 | 163 | 3 | 16 | 15 | 2 | 0 | 14 | 35 | — | — | 5.7 | 0 | no release files | no change |
| gosec Static Application Security Testing (SAST) › Language-specific › Go | v2.30.0 | 79 | 0 | 0 | 0 | 0 | 3 | 2 | 2 | — | 0 | 6.6 | 0 | verified | no change |
| semgrep Static Application Security Testing (SAST) › Multi-language | v1.183.0 | 215 | 2 | 26 | 31 | 13 | 0 | 21 | 71 | — | — | — | 8 | no release files | no change |
| cosign Artifact Signing & Verification | v3.1.4 | 319 | 0 | 0 | 1 | 0 | 4 | 4 | 3 | — | 1 | 8.2 | 7 | verified | no change |
| rekor Artifact Signing & Verification | v1.5.5 | 270 | 1 | 5 | 0 | 0 | 6 | 5 | 10 | — | 0 | 8.6 | 2 | verified | no change |
| slsa-verifier Supply Chain Compliance | v2.7.1 | 163 | 9 | 34 | 40 | 6 | 4 | 22 | 87 | — | 79 | — | 2 | verified | no change |
| snyk-cli Software Composition Analysis (SCA) | v1.1308.3 | 749 | 0 | 8 | 8 | 3 | 3 | 14 | 19 | — | 6 | — | 38 | checksums only | no change |
| sonarqube Static Application Security Testing (SAST) › Multi-language | 26.10.0.133078 | 3 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.9 | 1 | no release files | no change |
| spotbugs Static Application Security Testing (SAST) › Multi-language | 4.10.5 | 8 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.6 | 6 | no Linux binary | no change |
| sqlmap API & Dynamic Testing (DAST) | 1.10 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 4.9 | 2 | no release files | no change |
| kube-linter Kubernetes Security | v0.8.3 | 621 | 20 | 58 | 60 | 12 | 7 | 41 | 142 | — | 82 | 7.4 | 21 | signed, signer not checked | no change |
| nikto API & Dynamic Testing (DAST) | 2.6.1 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 3.8 | 7 | no release files | no change |
| talisman Pre-commit & Secrets Detection | v1.37.0 | 35 | 0 | 2 | 0 | 1 | 0 | 2 | 3 | — | 65 | 3.3 | 13 | checksums only | no change |
| trufflehog Pre-commit & Secrets Detection | v3.99.7 | 335 | 0 | 4 | 5 | 0 | 3 | 5 | 5 | — | — | 7.9 | 3 | verified | no change |
| steampipe Cloud Security | v2.4.9 | 229 | 3 | 9 | 2 | 3 | 3 | 7 | 15 | — | 12 | 6.8 | 14 | verified | no change |
| psalm Static Application Security Testing (SAST) › Language-specific › PHP | 6.20.5 | 68 | 0 | 0 | 1 | 0 | 0 | 1 | 1 | — | — | 4.7 | 1 | no Linux binary | no change |
| dive Container Security › Image Scanning | v0.13.1 | 79 | 1 | 17 | 14 | 3 | 2 | 10 | 32 | — | 86 | 3.4 | 28 | checksums only | first scan |
| wapiti API & Dynamic Testing (DAST) | 3.3.2 | 5 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | — | 10 | no Linux binary | no change |
| detect-secrets Pre-commit & Secrets Detection | v1.5.0 | 46 | 2 | 16 | 19 | 5 | 0 | 9 | 42 | — | — | 3.5 | 7 | no release files | no change |
| zap API & Dynamic Testing (DAST) | v2.17.0 | 18 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | — | — | 6.8 | 36 | no checksums or signatures | no change |
| zizmor Infrastructure as Code Security | v1.31.1 | 494 | 0 | 0 | 2 | 2 | 0 | 1 | 4 | — | — | — | 10 | verified | no change |
Critical … Unknown: advisory matches (one advisory can match several packages). Vulnerable packages: distinct package versions with a match, roughly the number of upgrades that clear the list. KEV: matches listed in the CISA Known Exploited Vulnerabilities catalog (— means not checked that week). In binary: Go tools only, advisories whose vulnerable functions are compiled into the released Linux binary. Scorecard: OpenSSF repository practices out of 10; * marks a score from the Scorecard CLI run by this workflow, † a score carried forward from an earlier week (hover for source and date, or for why a score is missing). Workflow: high-severity GitHub Actions findings from zizmor. Release: whether the Linux release file's signature, SLSA provenance, or GitHub attestation verifies against the project's own workflows. Select a column heading to sort.
How this report is made
Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.
| Tool | What it does here | Version this week |
|---|---|---|
| Syft | Generates a CycloneDX SBOM from each release's manifests and lockfiles. | 1.55.0 |
| Grype | Matches the SBOM against known vulnerabilities. | 0.121.0 |
| OSV-Scanner | Checks the same files against the OSV database to confirm or add matches. | 2.7.0 |
| govulncheck | For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary. | 1.9.0 |
| zizmor | Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions. | 1.31.1 |
| OpenSSF Scorecard | Scores repository security practices such as code review, branch protection, and pinned dependencies. | 5.6.0 |
| Cosign | Verifies Sigstore signatures on the release binary or its checksums file. | 3.1.4 |
| slsa-verifier | Verifies SLSA build provenance published with the release. | 2.7.1 |
| GitHub CLI attestations | Verifies GitHub artifact attestations for the release binary. | — |
| sbomlyze | Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer. | 0.6.0 |