# owasp-dep-scan/dep-scan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Repository: https://github.com/owasp-dep-scan/dep-scan
Canonical: https://ross.abutalabs.com/products/dep-scan
Homepage: https://depscan.readthedocs.io
Language: Python
License: MIT
License Family: permissive
Topics: vulnerability-scanners, cve, dependency-analysis, risk-audit, containers, sbom, sca, dependency-audit, compliance, cyclonedx, devsecops, security-audit, security-tools, vex, reachability-analysis, supply-chain-security
Last push: 2026-08-16T22:39:52+00:00

## Health v2 (maintenance only)
Score: 97/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 94, longevity 100
- inputs: {"age_days": 2409, "days_push": 17, "days_rel": 41, "gap_med": 23, "n_releases_24m": 10}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1281, forks 138 (observed 2026-08-28T04:04:13.800804+00:00)

## What it is
OWASP dep-scan is a security and risk audit CLI tool that scans project dependencies in local repositories and container images for known CVEs, license issues, and maintenance risks. It performs reachability analysis across multiple language ecosystems and generates SBOM, VDR, and VEX reports for CI integration.

## Use cases
- scan project dependencies for known cves
- audit container images for vulnerabilities
- generate sbom with vulnerability disclosure report
- perform reachability analysis on vulnerable packages
- detect dependency confusion attacks
- integrate dependency scanning into ci pipeline
- generate vex documents for compliance

## When to choose
- you need local, fast dependency vulnerability scanning without a server
- you want SBOM/VEX/VDR generation for compliance
- you need reachability analysis to prioritize real exploitable vulnerabilities
- you scan multiple ecosystems including containers and Linux distro packages

## When to avoid
- you need dynamic application security testing or runtime protection
- you want a hosted SaaS vulnerability management platform with dashboards
- you only need license compliance without vulnerability data

## Facets
- artifact type: cli-tool
- maturity: active
- function: vulnerability-scanning, dependency-audit, security, developer-tools, ci-cd
- domain: security, developer-tools
- platform: windows, cli, python
- tags: sbom, sca, vex, cyclonedx, supply-chain-security, reachability-analysis, container-scanning, owasp, devops, linux, macos, docker

## Member repositories
- owasp-dep-scan/dep-scan (main) score 97

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:13.800804+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:02:33.356143+00:00, confidence not recorded.
  - readme: https://github.com/owasp-dep-scan/dep-scan (fetched 2026-08-28T04:04:13.800804+00:00, sha eb6a0c592171)
  - homepage: https://depscan.readthedocs.io (fetched 2026-08-29T12:13:07.978555+00:00, sha 4c3055ca69ba)
- Data as of 2026-08-30T08:39:29.467469+00:00.