OSV-Scanner

Record the scanner version, inputs, database mode, and analysis failures. A package vulnerability match is not proof that vulnerable code is reachable.

Scan and review

osv-scanner --version
osv-scanner scan source --help

# Directory discovery, or an explicitly selected lockfile
osv-scanner scan source -r . --format json -o scan.json
osv-scanner scan source --lockfile package-lock.json

# Container image
osv-scanner scan image myapp:version --format json -o image.json