Back to Projects
VulnScan
Language-agnostic dependency vulnerability scanner CLI written in Go, querying OSV.dev to detect and score known vulnerabilities across Go, npm, and Python projects.
Architecture Overview
Stdlib-only Go CLI: a detector walks the project tree to identify ecosystems, self-registering Parser implementations extract dependencies, a worker-pool scanner queries pluggable vulnerability Providers (OSV.dev) concurrently, and results are scored and rendered via terminal/JSON/Markdown/CSV reporters.
Key Challenges
Designing a CVSS v3.1 base-score calculator from the raw vector spec for advisories that ship a vector but no pre-bucketed severity, and building an extensible Parser/Provider interface so new ecosystems and databases are additive, not invasive.
Security Considerations
Scans dependency manifests against known-vulnerability data (OSV.dev), computes severity and a security score per project, and generates remediation commands as a review-before-you-run script rather than auto-applying fixes.
Future Improvements
Planned: Rust/Java/.NET/PHP/Ruby/Docker/Terraform ecosystem parsers, additional providers (GHSA, NVD), SARIF/HTML output, SBOM generation (CycloneDX/SPDX), typosquat/malicious-package detection, and CI templates.
Technical Impact
- Built a stdlib-only Go CLI that detects project ecosystems and parses Go, npm, and Python dependency manifests.
- Integrated the OSV.dev API for batch vulnerability queries and implemented a CVSS v3.1 base-score calculator from scratch.
- Designed a concurrent worker-pool scanner with context-based cancellation, an on-disk TTL cache, and offline scan mode.
- Built a pluggable Parser/Provider architecture so new ecosystems and vulnerability databases can be added without touching core logic.