vet scans dependencies for malware and enforces security policies using code. It analyzes code usage to prioritize actual risks, complementing traditional SCA tools that often produce excessive noise. vet uses a pipeline architecture involving readers, enrichers, a CEL policy engine, and reporters, leveraging SafeDep Cloud for real-time insights.
vet differentiates itself through its focus on actual code usage to filter noise, differentiating it from traditional SCA tools. It empowers policy-as-code with CEL expressions. It supports multiple package managers, container images, and SBOM formats. Integration with CI/CD systems is streamlined via GitHub Actions and GitLab CI components.
- Malicious Package Detection: Real-time protection against zero-day malware through static and dynamic analysis.
- Vulnerability Analysis: Prioritizes risks based on actual code usage, reducing noise from irrelevant vulnerabilities.
- Policy as Code: Enables defining and enforcing security policies using CEL expressions for license compliance and score requirements.
- Multi-Ecosystem Support: Supports a wide range of package managers, container images, and SBOM formats.
- CI/CD Integration: Seamlessly integrates into CI/CD pipelines via GitHub Actions and GitLab CI components.
- Container Scanning: Supports scanning container images directly within CI/CD workflows.
- Transparency & Reporting: Provides actionable reports in SARIF, JSON, and Markdown formats.
vet is an actively developed project with a robust architecture and growing community adoption. Regular releases, active issue triage, and comprehensive documentation indicate ongoing maintenance and support. The integration with SafeDep Cloud provides reliable malware detection. SLSA 3 compliance ensures a high degree of code integrity.
Developers and security teams benefit from vet by mitigating supply chain risks and enforcing security best practices. It addresses the need for proactive, context-aware security evaluation of software dependencies, enabling faster and more secure software development lifecycles. vet offers a more precise and actionable approach compared to traditional vulnerability scanning tools, providing clear guidance on which risks to address.