sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 62 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei)
CI / Check (push) Skipped
CI / Check (pull_request) Failing after 3m1s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details

Browse Source 
CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS
CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the
in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the
Certifai requirements spec (Collectives) with the code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
This commit is contained in:
Sharang Parnerkar
2026-08-31 15:05:06 +02:00
co-authored by Claude Fable 5
parent 0834547a74
commit b7b9c812ab
6 changed files with 14 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guide/sbom.md
+1 -1
View File
@@ -6,7 +6,7 @@ The SBOM (Software Bill of Materials) feature provides a complete inventory of a
A Software Bill of Materials is a list of every component (library, package, framework) that your software depends on, along with version numbers, licenses, and known vulnerabilities. SBOMs are increasingly required for compliance audits, customer security questionnaires, and supply chain transparency.
Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and Grype for vulnerability matching.
Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and OSV.dev + NVD for vulnerability matching.
## Packages Tab