Introducing Vulnfy: A Lightweight, Multi-Ecosystem Vulnerability Scanner for Your CI/CD Pipeline

wxwreak — Sun, 16 Aug 2026 17:15:12 +0000

Hey DEV community!👋
As developers, we all know how crucial dependency and container security is. But let's be honest - sometimes heavy enterprise security tools are overkill for side projects, smaller apps, or quick sanity checks. I wanted something lightweight, fast and dead-simple to integrate into Github Actions without complex configurations.

That's why I build Vulnfy - an open-source, cross-platform dependency and container vulnerability scanner written in Python. It automatically detects project configuration and lock files across multiple langs, queries the OSV API in bulk, and alerts you instantly.

What Makes Vulnfy Different?

Multi-Ecosystem Support: Scans dependencies for Python, Node.js, Go, PHP, Rust, and container base images.
Batch OSV API Integration: Efficiently checks packages in bulk using the OSV batch query API.
Smart Notifications: Automatically sends alerts to Discord or Telegram only when vulnerabilities match or exceed your configured threshold, completely eliminating spam when your codebase is clean.
CI/CD Ready & Threshold Control: Use --fail-on <level> to customize when the build fails (low, medium, high, critical).
Vulnerability Suppression (.vulnignore): Easily ignore known or unfixable vulnerabilities directly from your project's root directory to prevent CI blockage and alert fatigue.
Automatic Dependency Resolution: Automatically installs missing requirements (requests, colorama, PyYAML) on first run.
Structured Output: Exports all discovered vulnerabilities and associated CVEs into a clean JSON report.

Supported Ecosystems & Files

Ecosystem	Files
Python	requirements.txt, pyproject.toml
NPM	package.json, package-lock.json
Go	go.mod
PHP	composer.lock
Rust	Cargo.lock, Cargo.toml
Docker	Dockerfile, docker-compose.yml

Quick Start & Installation

You can install Vulnfy quickly or pull it directly from Github:

pip install git+https://github.com/wxwreak/vulnfy.git

Or run it locally with a simple command in your project directory:

vulnfy

Github Actions Integration

Adding Vulnfy to your CI/CD workflow takes just a few lines. Create .github/workflows/scan.yaml:

name: Vulnfy Security Scan

on:
  push:
    branches: [ main ]
  workflow_dispatch:

jobs:
  vulnfy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Vulnfy
        run: pip install git+https://github.com/wxwreak/vulnfy.git

      - name: Run Vulnfy Scanner
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: vulnfy --fail-on high

Configuration & Alerts

Want to hook it up to Telegram or Discord? Just drop a vulnfy.yaml file into your root directory:

notifications:
  discord:
    enabled: true   # Set to true for Discord alerts
  telegram:
    enabled: false  # Set to true for Telegram alerts

(And store your webhooks/tokens securely in Github Secrets/.env file).

🎉 Tackling Alert Fatigue: Big Updates to Vulnfy Security Scanner!

Huge thanks to the community feedback pointing out that lightweight security tools must avoid alert fatigue. Nobody wants a security scanner that pings them for every single low-severity flaw or spam notification when the codebase is clean.

Based on that feedback, I've just pushed a fresh update to Vulnfy—a lightweight, cross-platform dependency and container vulnerability scanner written in Python.

Here is what is new in this release:

1. Smart Notifications & Severity Thresholds

Notifications to Discord and Telegram are now completely customizable. Vulnfy will only send alerts when vulnerabilities match or exceed your configured threshold (e.g., --fail-on medium or high), completely eliminating spam.

2. Multi-Format Reporting

Beyond the default JSON, Vulnfy now natively supports exporting your scan reports into:

📄 HTML (with custom styling support)
📝 Markdown
📊 CSV
⚙️ YAML
📑 PDF (via HTML templates)

3. Vulnerability Suppression (`.vulnignore`)

Got a false positive or a vulnerability you can't fix right this second? Just add the CVE or ID to a .vulnignore file in your root directory. Ignored items won't trigger CI failures or spam your chat channels.

4. CLI Enhancements (`--no-cache`)

Added the --no-cache argument to keep your workspace clean and prevent Python from generating unnecessary __pycache__ and bytecode files during scans.

Give it a Try!

Vulnfy is completely open-source, and i'm actively working on improving it.

Check out the repo on Github: ⭐️
Let me know what you think in the comments below!

DEV Community: wxwreak