Docs

Vulnerability scan

Every component version against public advisories, matched on your machine.

cra scan                          # the SBOM from cra.yaml
cra scan --format json file.json  # or markdown
cra scan --offline                # no requests: the cached copy only

For each advisory that names a component version, cra scan shows the advisory and its other IDs, the rating, the fixed versions, whether it is known to be exploited, its EPSS score, and your decision. Advisories you have not decided come first, exploited ones at the top.

Where the data comes from #

cra downloads a signed snapshot of public advisories, made once a day, and only the files for the ecosystems in your SBOM. It checks the signature and the SHA-256 of each file, keeps a copy in ~/.cache/shipward, and never accepts a copy older than the one it already has. The matching happens on your machine: no package name is sent anywhere.

Two feeds come from their publishers directly, because their terms do not clearly allow us to pass them on: ENISA’s list of exploited vulnerabilities (EUVD) and FIRST’s EPSS scores. cra downloads both itself and keeps them for 20 hours.

What a finding means #

An advisory that names a version does not prove your product is affected. The vulnerable code may never run in your product. A person decides that, and records it as a decision.

In CI #

cra scan --summary "$GITHUB_STEP_SUMMARY"   # a table in the job summary
cra scan --fail-on exploited                # exit 3 when an undecided advisory is known to be exploited
cra scan --fail-on open                     # exit 3 when any advisory has no final decision

--fail-on is off by default. Shipward reports; you decide what stops a release.