A vulnerability scanner for container images and filesystems
Pure-Rust Android decompiler and security-audit suite. DEX → Java, Hermes → JavaScript. Cross-layer taint across the React Native bridge. CycloneDX SBOM + OpenVEX. CLI and MCP. Bytecode is not a security layer.
Guided VEX authoring for OSS maintainers — from zero to a published VEX document in one command.
CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.
SBOM diff with supply-chain risk signals — flags new CVEs, typosquats, and young maintainers on changed deps. Built after axios (Mar 2026), Shai-Hulud, and xz.
Which of your products does this CVE reach? SBOM dependency graph with CISA KEV, EPSS and OpenVEX. Single static Go binary. Continuation of Minefield.
Reachability-based CVE triage engine: proves whether your code reaches each vulnerable dependency function and emits OpenVEX / CycloneDX VEX evidence
CycloneDX & SPDX SBOM generator, vulnerability scanner, EPSS exploit predictor, VEX engine, and compliance auditor for VS Code.
Open-source web security verification workspace: OWASP-aligned dynamic scanning, local static analysis, evidence-based OpenVEX drafts and an MCP server.
APK / AAB / XAPK parser and security analysis library. Signing v1–v4 + ROCA / Fermat / Wiener / batch-GCD. CycloneDX SBOM with .rodata byte anchors. OpenVEX. YARA-X. Pure Rust.
Vulnerability scanner whose every result is a reproducible, signed claim. Pins the lockfile, the OSV feed, the version comparators, and the exclusions to four digests inside a signed in-toto predicate, so anyone can replay a scan byte for byte, or get a diff naming exactly which input moved.
CRA Article 14 dossiers from an embedded Linux build tree. Scan Yocto or Buildroot, decide affectedness with the evidence shown, emit CSAF, OpenVEX and SRP with the statutory clock running. Zero runtime dependencies, offline-capable.
Ultra-fast open-source code security scanner. Finds vulnerabilities across 8 languages (Rust, Go, Python, JS, TS, Java, C, C++) using SAST + taint analysis + LLM verification — fewer false positives, faster audits. Outputs Sigstore-signed SARIF, SBOM, and OpenVEX bundles for supply-chain compliance.
Match ICS/OT security advisories to your asset inventory. CSAF-native, offline, order-numbers-first because CPE covers 0.1% of the corpus.
VEX document crawler and aggregator
TypeScript library for creating and managing OpenVEX documents
To associate your repository with the openvex topic, visit your repo's landing page and select "manage topics."