sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 62 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei)
CI / Check (push) Skipped
CI / Check (pull_request) Failing after 3m1s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details

Browse Source 
CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS
CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the
in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the
Certifai requirements spec (Collectives) with the code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
This commit is contained in:
Sharang Parnerkar
2026-08-31 15:05:06 +02:00
co-authored by Claude Fable 5
parent 0834547a74
commit b7b9c812ab
6 changed files with 14 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/glossary.md
+2 -2
View File
@@ -58,8 +58,8 @@ An open-source static analysis tool that finds bugs and enforces code standards
**Syft**
An open-source tool for generating SBOMs from container images and filesystems. Used by Certifai to extract dependency information.
**Grype**
An open-source vulnerability scanner for container images and filesystems. Used by Certifai to match dependencies against known vulnerabilities.
**OSV.dev**
Google's open distributed vulnerability database, queried by package URL. Certifai uses it (together with NVD) to match SBOM components against known vulnerabilities.
## Protocols