Scan Dependencies, Source Code, and Docker Images
DevGuard's scanner covers your whole software supply chain: project dependencies, first-party source code, container images, and pre-generated SBOMs. This guide covers all of them — pick the section you need, or run them all.
- Scan Dependencies — Software Composition Analysis (SCA), matched against OSV.dev
- Scan Source Code — SAST, secret scanning, and Infrastructure as Code (IaC) checks
- Scan Docker Images — container image scanning with attestation discovery
- Upload an Existing SBOM — import an SBOM generated by another tool
For the full list of flags and subcommands, see the devguard-scanner CLI reference.
Built on Established Open-Source Scanners
DevGuard doesn't reimplement scanning engines — there are already excellent, battle-tested open-source tools for each job. Instead, devguard-scanner wraps them and adds a consistent CLI, SBOM/SARIF normalization, and server-side vulnerability matching against DevGuard's own database:
| Scan Type | Underlying Tool |
|---|---|
| Scan Dependencies (SCA) | Trivy for SBOM generation, matched server-side against DevGuard's own vulnerability database |
| Scan Docker Images | Trivy, same as above |
| Scan Source Code (SAST) | Semgrep |
| Infrastructure as Code (IaC) | Checkov |
| Secret Scanning | Gitleaks |
| Signing & Attestations | cosign |
| Provenance | in-toto |
Prerequisites
Before you begin, ensure you have:
- Docker or the
devguard-scannerbinary installed - A personal access token from DevGuard (create one in user settings)
- A repository created in DevGuard
Installation
No installation needed — run the scanner directly via Docker:
Scan Dependencies
Run Software Composition Analysis (SCA) to scan your project dependencies for known vulnerabilities and generate a Software Bill of Materials (SBOM). DevGuard matches discovered components against the OSV.dev vulnerability database, covering npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems, and many more. To learn more, see Software Composition Analysis.
Example Output
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| LIBRARY | VULNERABILITY | RISK | CVSS | INSTALLED | FIXED | STATUS |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/apache/thrift | GHSA-wf45-q9ch-q8gh | 7.50 | 7.5 | v0.16.0 | v0.23.0 | false_positive |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/cloudflare/golz4 | GHSA-4wp2-8rm2-jgmh | 9.80 | 9.8 | v0.0.0-20150217214814-ef862a3cdc58 | v0.0.0-20140711154735-199f5f787806 | false_positive |
| | GO-2020-0022 | 0.00 | 0.0 | v0.0.0-20150217214814-ef862a3cdc58 | v0.0.0-20140711154735-199f5f787806 | false_positive |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/jackc/pgproto3/v2 | GHSA-jqcq-xjh3-6g23 | 7.50 | 7.5 | v2.3.3 | v2.3.4 | exploitable |
| | GHSA-x6gf-mpr2-68h6 | 7.50 | 7.5 | v2.3.3 | v2.3.4 | exploitable |
| | GO-2026-4518 | 0.00 | 0.0 | v2.3.3 | | in_triage |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/jackc/pgx/v4 | GHSA-j88v-2chj-qfwx | 2.30 | 0.0 | v4.18.2 | v4.18.4 | in_triage |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| golang.org/x/sys | GO-2026-5024 | 0.00 | 0.0 | v0.8.0 | v0.44.0 | in_triage |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
The output shows each affected library with its vulnerabilities, the contextual Risk score, raw CVSS score, currently installed version, available fix version, and current status. New findings start as in_triage; DevGuard or your team can later mark them exploitable, false_positive, or fixed as part of the vulnerability lifecycle.
What the scanner does:
- Generates SBOM: Creates a complete inventory of all software components and dependencies in your project. See Supplementary SBOMs for more on how DevGuard works with SBOM data.
- Uploads Data: Sends the SBOM to DevGuard, signed via HTTP Message Signing for integrity verification.
- Server-Side Matching: DevGuard matches all components against its vulnerability database using vulnerability matching and returns results.
Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with severity scores, affected components, and fix recommendations. Learn more about vulnerability types and the vulnerability lifecycle.
Advanced Options
For the full list of sca flags (--artifactName, --origin, --ref, --defaultRef, --isTag, and more), see the sca reference.
Scan Source Code
Scan your source code for security issues, bad practices, and leaked secrets. DevGuard detects first-party vulnerabilities in your own code using multiple analysis techniques.
Run Static Application Security Testing (SAST) to identify security vulnerabilities and bad practices in your source code:
What the scanner does:
- Analyzes Source Code: Scans your repository for security vulnerabilities, bad practices, and secrets
- Generates SARIF Report: Creates a structured Security Analysis Results Format (SARIF) report with findings
- Uploads Results: Sends the SARIF report to DevGuard
- Server-Side Processing: DevGuard processes and normalizes the findings for consistent tracking
Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with the locations in your code.
Advanced Options
The sast, secret-scanning, and iac commands share most flags with sca. See the sast, secret-scanning, and iac references for the full list.
Scan Docker Images
Scan container images for known vulnerabilities and generate a Software Bill of Materials (SBOM).
Scan a container image directly from a public registry:
What the scanner does:
- Generates SBOM: Creates a complete inventory of all software components in your container, merging in any embedded SBOMs that describe custom binaries the scan alone can't resolve
- Discovers Attestations: Automatically extracts relevant attestations (e.g., VEX documents) from base images
- Uploads Data: Sends the SBOM and discovered attestations to DevGuard
- Server-Side Scanning: DevGuard analyzes all components against its vulnerability database and returns results
Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with severity scores, affected components, and fix recommendations.
Advanced Options
For the full list of container-scanning flags — including --artifactName, --ignoreUpstreamAttestations, and --ignoreExternalReferences — see the container-scanning reference.
Upload an Existing SBOM
Upload an existing Software Bill of Materials (SBOM) to DevGuard for vulnerability analysis. This is useful when you already have an SBOM generated by another tool and want DevGuard to scan it against known vulnerabilities.
You can also call the API directly with curl instead of using the scanner CLI — authenticate with your personal access token as a Bearer token and identify the target repository via the X-Asset-Name header:
The response is a CycloneDX VEX document listing the detected vulnerabilities for the components in your SBOM.
What the scanner does:
- Parses SBOM: Reads and validates your CycloneDX SBOM file
- Scans Components: Analyzes all software components listed in the SBOM
- Checks Vulnerabilities: Cross-references each component against DevGuard's vulnerability database
- Reports Findings: Returns detected vulnerabilities with severity scores and remediation guidance
- Updates Repository: Syncs findings with your DevGuard repository for tracking
Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with affected components and fix recommendations.
Merge and Scan Multiple SBOMs
Use merge-sboms to combine multiple CycloneDX SBOMs and pipe the result directly into the sbom command for scanning. Pass - as the file argument to read from stdin:
The merge config file specifies the target purl and the list of SBOM files to merge:
To save the merged scan results to DevGuard, add authentication flags:
Advanced Options
For the full list of sbom flags — including --artifactName, --origin, --ref, --defaultRef, and --isTag — see the sbom reference.
Scan Without Authentication
You don't need a DevGuard account, a self-hosted instance, or a personal access token to get vulnerability results. Every scan command above can also run without saving results to DevGuard — useful for a quick local scan, trying out the scanner, or checking a build artifact in CI without a token. The HTTP API below works the same way: just upload an SBOM to api.devguard.org and get results back, with nothing to sign up for or host yourself.
CLI: Skip the Token and Asset Name
Omit --token and --assetName and the scanner prints results to the terminal instead of persisting them:
The scanner prints a warning and returns results without persisting them:
Warning: You are scanning without saving the results. Provide --token and --assetName to save results to DevGuard.
HTTP API: Scan an SBOM Directly
For scripting or integrations outside the devguard-scanner CLI, you can POST a CycloneDX SBOM directly to DevGuard's public API and get vulnerability results back without any authentication:
The response is always a CycloneDX VEX document. Since there's no repository to track state against, every detected vulnerability is reported with a status of in_triage — DevGuard hasn't had a chance to apply any triage decisions to it.
CI/CD Integration
For automated scanning in CI/CD pipelines, DevGuard provides ready-to-use integrations:
- GitHub Actions: See Scan with GitHub Actions for setup instructions
- GitLab CI: See Scan with GitLab CI for setup instructions