wapiti
Scan web applications for vulnerabilities with black-box testing
Changes since last week
no change.
Known vulnerabilities
No known advisories matched the declared dependencies.
Second opinion: OSV-Scanner
OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.
Release integrity
Verdict: no Linux binary.
- Checksums file: no
- Signatures: no
- SLSA provenance: no
- SBOM published with the release: no
Verified means a signature, provenance, or attestation was checked against an identity in wapiti-scanner/wapiti's own GitHub Actions workflows.
Repository security (OpenSSF Scorecard)
No Scorecard result yet (the project is not in the OpenSSF public dataset; the Scorecard CLI fallback was skipped because this shard's weekly budget was used). Results are added as the weekly budget allows.
GitHub Actions workflow audit (zizmor)
15 potential issues in 1 workflow files at this release: 10 high, 5 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.
All findings
Dependencies (5)
By ecosystem: github 5.
Licenses (as declared in the SBOM): unknown 5.
github (5)
| Name | Version | License | Declared in |
|---|---|---|---|
actions/checkout | v4 | .github/workflows/main.yml | |
actions/setup-python | v5 | .github/workflows/main.yml | |
actions/upload-artifact | v4 | .github/workflows/main.yml | |
codecov/codecov-action | v4 | .github/workflows/main.yml | |
docker/setup-buildx-action | v3 | .github/workflows/main.yml |
History
| Week | Version | Dependencies | Critical | High | Medium | Low | Unknown | Changes |
|---|---|---|---|---|---|---|---|---|
| 2026-11-02 | 3.3.2 | 5 | 0 | 0 | 0 | 0 | 0 | — |
| 2026-11-01 | 3.3.2 | 5 | 0 | 0 | 0 | 0 | 0 | — |
SBOM minimum elements
Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.
| Standard | Score | Checks passed | Failed checks |
|---|---|---|---|
| NTIA 2021 | 71 | 5/7 | Supplier Name, Dependency Relationship |
| CISA 2025 | 50 | 5/10 | Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author |
| BSI TR-03183 | 44 | 4/9 | Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact |
Evidence
Downloads for this week: CycloneDX SBOM · Grype report
Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/wapiti-scanner__wapiti/.
2 manifests and lockfiles scanned
.github/workflows/main.yml, pyproject.toml
Full JSON for this project · Atom feed of weekly changes
Badges
shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.
[](https://rezmoss.github.io/awesome-security-pipeline/projects/wapiti-scanner/wapiti/index.html)How this report is made
Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.
| Tool | What it does here | Version this week |
|---|---|---|
| Syft | Generates a CycloneDX SBOM from each release's manifests and lockfiles. | 1.55.0 |
| Grype | Matches the SBOM against known vulnerabilities. | 0.121.0 |
| OSV-Scanner | Checks the same files against the OSV database to confirm or add matches. | 2.7.0 |
| govulncheck | For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary. | 1.9.0 |
| zizmor | Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions. | 1.31.1 |
| OpenSSF Scorecard | Scores repository security practices such as code review, branch protection, and pinned dependencies. | 5.6.0 |
| Cosign | Verifies Sigstore signatures on the release binary or its checksums file. | 3.1.4 |
| slsa-verifier | Verifies SLSA build provenance published with the release. | 2.7.1 |
| GitHub CLI attestations | Verifies GitHub artifact attestations for the release binary. | — |
| sbomlyze | Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer. | 0.6.0 |