Scan Dependencies, Source Code, and Docker Images

DevGuard's scanner covers your whole software supply chain: project dependencies, first-party source code, container images, and pre-generated SBOMs. This guide covers all of them — pick the section you need, or run them all.

For the full list of flags and subcommands, see the devguard-scanner CLI reference.

Built on Established Open-Source Scanners

DevGuard doesn't reimplement scanning engines — there are already excellent, battle-tested open-source tools for each job. Instead, devguard-scanner wraps them and adds a consistent CLI, SBOM/SARIF normalization, and server-side vulnerability matching against DevGuard's own database:

Scan TypeUnderlying Tool
Scan Dependencies (SCA)Trivy for SBOM generation, matched server-side against DevGuard's own vulnerability database
Scan Docker ImagesTrivy, same as above
Scan Source Code (SAST)Semgrep
Infrastructure as Code (IaC)Checkov
Secret ScanningGitleaks
Signing & Attestationscosign
Provenancein-toto

Prerequisites

Before you begin, ensure you have:

  • Docker or the devguard-scanner binary installed
  • A personal access token from DevGuard (create one in user settings)
  • A repository created in DevGuard

Installation

No installation needed — run the scanner directly via Docker:

Scan Dependencies

Run Software Composition Analysis (SCA) to scan your project dependencies for known vulnerabilities and generate a Software Bill of Materials (SBOM). DevGuard matches discovered components against the OSV.dev vulnerability database, covering npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems, and many more. To learn more, see Software Composition Analysis.

Example Output

+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| LIBRARY                      | VULNERABILITY       | RISK | CVSS | INSTALLED                          | FIXED                              | STATUS         |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/apache/thrift     | GHSA-wf45-q9ch-q8gh | 7.50 | 7.5  | v0.16.0                            | v0.23.0                            | false_positive |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/cloudflare/golz4  | GHSA-4wp2-8rm2-jgmh | 9.80 | 9.8  | v0.0.0-20150217214814-ef862a3cdc58 | v0.0.0-20140711154735-199f5f787806 | false_positive |
|                              | GO-2020-0022        | 0.00 | 0.0  | v0.0.0-20150217214814-ef862a3cdc58 | v0.0.0-20140711154735-199f5f787806 | false_positive |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/jackc/pgproto3/v2 | GHSA-jqcq-xjh3-6g23 | 7.50 | 7.5  | v2.3.3                             | v2.3.4                             | exploitable    |
|                              | GHSA-x6gf-mpr2-68h6 | 7.50 | 7.5  | v2.3.3                             | v2.3.4                             | exploitable    |
|                              | GO-2026-4518        | 0.00 | 0.0  | v2.3.3                             |                                    | in_triage      |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| github.com/jackc/pgx/v4      | GHSA-j88v-2chj-qfwx | 2.30 | 0.0  | v4.18.2                            | v4.18.4                            | in_triage      |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+
| golang.org/x/sys             | GO-2026-5024        | 0.00 | 0.0  | v0.8.0                             | v0.44.0                            | in_triage      |
+------------------------------+---------------------+------+------+------------------------------------+------------------------------------+----------------+

The output shows each affected library with its vulnerabilities, the contextual Risk score, raw CVSS score, currently installed version, available fix version, and current status. New findings start as in_triage; DevGuard or your team can later mark them exploitable, false_positive, or fixed as part of the vulnerability lifecycle.

What the scanner does:

  1. Generates SBOM: Creates a complete inventory of all software components and dependencies in your project. See Supplementary SBOMs for more on how DevGuard works with SBOM data.
  2. Uploads Data: Sends the SBOM to DevGuard, signed via HTTP Message Signing for integrity verification.
  3. Server-Side Matching: DevGuard matches all components against its vulnerability database using vulnerability matching and returns results.

Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with severity scores, affected components, and fix recommendations. Learn more about vulnerability types and the vulnerability lifecycle.

Advanced Options

For the full list of sca flags (--artifactName, --origin, --ref, --defaultRef, --isTag, and more), see the sca reference.

Scan Source Code

Scan your source code for security issues, bad practices, and leaked secrets. DevGuard detects first-party vulnerabilities in your own code using multiple analysis techniques.

Run Static Application Security Testing (SAST) to identify security vulnerabilities and bad practices in your source code:

What the scanner does:

  1. Analyzes Source Code: Scans your repository for security vulnerabilities, bad practices, and secrets
  2. Generates SARIF Report: Creates a structured Security Analysis Results Format (SARIF) report with findings
  3. Uploads Results: Sends the SARIF report to DevGuard
  4. Server-Side Processing: DevGuard processes and normalizes the findings for consistent tracking

Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with the locations in your code.

Advanced Options

The sast, secret-scanning, and iac commands share most flags with sca. See the sast, secret-scanning, and iac references for the full list.

Scan Docker Images

Scan container images for known vulnerabilities and generate a Software Bill of Materials (SBOM).

Scan a container image directly from a public registry:

What the scanner does:

  1. Generates SBOM: Creates a complete inventory of all software components in your container, merging in any embedded SBOMs that describe custom binaries the scan alone can't resolve
  2. Discovers Attestations: Automatically extracts relevant attestations (e.g., VEX documents) from base images
  3. Uploads Data: Sends the SBOM and discovered attestations to DevGuard
  4. Server-Side Scanning: DevGuard analyzes all components against its vulnerability database and returns results

Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with severity scores, affected components, and fix recommendations.

Advanced Options

For the full list of container-scanning flags — including --artifactName, --ignoreUpstreamAttestations, and --ignoreExternalReferences — see the container-scanning reference.

Upload an Existing SBOM

Upload an existing Software Bill of Materials (SBOM) to DevGuard for vulnerability analysis. This is useful when you already have an SBOM generated by another tool and want DevGuard to scan it against known vulnerabilities.

You can also call the API directly with curl instead of using the scanner CLI — authenticate with your personal access token as a Bearer token and identify the target repository via the X-Asset-Name header:

The response is a CycloneDX VEX document listing the detected vulnerabilities for the components in your SBOM.

What the scanner does:

  1. Parses SBOM: Reads and validates your CycloneDX SBOM file
  2. Scans Components: Analyzes all software components listed in the SBOM
  3. Checks Vulnerabilities: Cross-references each component against DevGuard's vulnerability database
  4. Reports Findings: Returns detected vulnerabilities with severity scores and remediation guidance
  5. Updates Repository: Syncs findings with your DevGuard repository for tracking

Verify it worked: Navigate to your repository in DevGuard. You'll see detected vulnerabilities listed with affected components and fix recommendations.

Merge and Scan Multiple SBOMs

Use merge-sboms to combine multiple CycloneDX SBOMs and pipe the result directly into the sbom command for scanning. Pass - as the file argument to read from stdin:

The merge config file specifies the target purl and the list of SBOM files to merge:

To save the merged scan results to DevGuard, add authentication flags:

Advanced Options

For the full list of sbom flags — including --artifactName, --origin, --ref, --defaultRef, and --isTag — see the sbom reference.

Scan Without Authentication

You don't need a DevGuard account, a self-hosted instance, or a personal access token to get vulnerability results. Every scan command above can also run without saving results to DevGuard — useful for a quick local scan, trying out the scanner, or checking a build artifact in CI without a token. The HTTP API below works the same way: just upload an SBOM to api.devguard.org and get results back, with nothing to sign up for or host yourself.

CLI: Skip the Token and Asset Name

Omit --token and --assetName and the scanner prints results to the terminal instead of persisting them:

The scanner prints a warning and returns results without persisting them:

Warning: You are scanning without saving the results. Provide --token and --assetName to save results to DevGuard.

HTTP API: Scan an SBOM Directly

For scripting or integrations outside the devguard-scanner CLI, you can POST a CycloneDX SBOM directly to DevGuard's public API and get vulnerability results back without any authentication:

The response is always a CycloneDX VEX document. Since there's no repository to track state against, every detected vulnerability is reported with a status of in_triage — DevGuard hasn't had a chance to apply any triage decisions to it.

CI/CD Integration

For automated scanning in CI/CD pipelines, DevGuard provides ready-to-use integrations:

Have feedback? We want to hear from you!

Fields marked with * are required