Simple Vulnerability Scanner (SVS)

SVS scans a CycloneDX SBOM (JSON) and checks listed software versions against OSV to produce a clean JSON + HTML vulnerability report.

What you get

• Professional SBOM input: CycloneDX JSON v1.5 and SPDX JSON 2.3
• Online CVE source: OSV API (aggregates multiple ecosystems)
• Outputs: JSON (machine-friendly) + HTML (human-friendly)

Quick start

1. Create a CycloneDX or SPDX JSON SBOM using your build tooling or CI pipeline.
2. Run the scanner:

svs scan --sbom path/to/sbom.json --out reports

Common commands:

svs scan --sbom examples/sample-sbom.json --out reports
svs summary --latest --dir reports --out svs-summary.md
svs open-report --dir reports
svs demo --out reports

Outputs:

• reports/<sbom-name>_<timestamp>.json
• reports/<sbom-name>_<timestamp>.html
• reports/<sbom-name>_<timestamp>.sarif.json

You can try the included sample:

svs scan --sbom examples/sample-sbom.json --out reports

Or try the SPDX sample:

svs scan --sbom examples/sample-spdx.json --out reports

For a full local demo (scan + summary + open report):

svs demo --out reports

Demo options:

svs demo --out reports --no-open
svs demo --out reports --min-severity high
svs demo --sbom path/to/your-sbom.json --out reports --summary-out svs-summary.md
svs demo --both-samples --out reports

Quick SBOM generation

Python (cyclonedx-bom)

python -m pip install cyclonedx-bom
cyclonedx-py environment --output-format JSON --spec-version 1.5 -o sbom.cdx.json

Python (requirements.txt)

python -m pip install cyclonedx-bom
cyclonedx-py requirements requirements.txt --output-format JSON --spec-version 1.5 -o sbom.cdx.json

Node.js (npm)

npm sbom --sbom-format=cyclonedx --sbom-type=application > sbom.cdx.json

Notes

• SVS expects components to have purl fields for best matching.
• Components without purl are reported but skipped from OSV queries.
• Use --timeout and --retries to tune OSV network behavior.
• Use --sarif/--no-sarif to toggle SARIF output.
• Use --min-severity to filter results (none/low/medium/high/critical).
• PR summary includes upgrade risk labels; SARIF rules include upgrade hints when available.
• Use svs summary --report <report.json> or svs summary --latest --dir reports to generate the PR summary locally.
• Use svs open-report --dir reports (or --path report.html) to open the latest HTML report.
• Use svs demo --out reports to run a full local demo (scan + summary + open report).
• Demo flags: --no-open to skip opening the browser, --min-severity to filter results, --summary-out to control the summary filename, --both-samples to scan CycloneDX + SPDX samples.

Community & Governance

• Code of Conduct: CODE_OF_CONDUCT.md
• Contributing guide: CONTRIBUTING.md
• Security policy: SECURITY.md
• Roadmap: ROADMAP.md
• The HTML report includes client-side search, severity filters, a distribution chart, and a top-vulnerabilities table.

GitHub Actions (SARIF upload)

The included workflow .github/workflows/svs-scan.yml detects the project type and generates a CycloneDX SBOM in CI, runs SVS, uploads the SARIF report to GitHub code scanning, and posts a summary comment on pull requests (including top vulnerabilities and upgrade hints).

• Python projects: cyclonedx-py (CycloneDX BOM CLI)
• Node.js projects: npm sbom in CycloneDX mode
• Everything else: Anchore SBOM action fallback

By default it writes sbom.cdx.json. You can override the SBOM path when triggering the workflow manually via the sbom_path input.

Roadmap (high level)

• More SBOM formats (SPDX)
• Additional output formats (SARIF)
• Enriched severity analytics