Hey DEV community!👋
As developers, we all know how crucial dependency and container security is. But let's be honest - sometimes heavy enterprise security tools are overkill for side projects, smaller apps, or quick sanity checks. I wanted something lightweight, fast and dead-simple to integrate into Github Actions without complex configurations.
That's why I build Vulnfy - an open-source, cross-platform dependency and container vulnerability scanner written in Python. It automatically detects project configuration and lock files across multiple langs, queries the OSV API in bulk, and alerts you instantly.
What Makes Vulnfy Different?
- Multi-Ecosystem Support: Scans dependencies for Python, Node.js, Go, PHP, Rust, and container base images.
- Batch OSV API Integration: Efficiently checks packages in bulk using the OSV batch query API.
- Smart Notifications: Automatically sends alerts to Discord or Telegram only when vulnerabilities match or exceed your configured threshold, completely eliminating spam when your codebase is clean.
-
CI/CD Ready & Threshold Control: Use
--fail-on <level>to customize when the build fails (low,medium,high,critical). -
Vulnerability Suppression (
.vulnignore): Easily ignore known or unfixable vulnerabilities directly from your project's root directory to prevent CI blockage and alert fatigue. -
Automatic Dependency Resolution: Automatically installs missing requirements (
requests,colorama,PyYAML) on first run. - Structured Output: Exports all discovered vulnerabilities and associated CVEs into a clean JSON report.
Supported Ecosystems & Files
| Ecosystem | Files |
|---|---|
| Python | requirements.txt, pyproject.toml |
| NPM | package.json, package-lock.json |
| Go | go.mod |
| PHP | composer.lock |
| Rust | Cargo.lock, Cargo.toml |
| Docker | Dockerfile, docker-compose.yml |
Quick Start & Installation
You can install Vulnfy quickly or pull it directly from Github:
pip install git+https://github.com/wxwreak/vulnfy.git
Or run it locally with a simple command in your project directory:
vulnfy
Github Actions Integration
Adding Vulnfy to your CI/CD workflow takes just a few lines. Create .github/workflows/scan.yaml:
name: Vulnfy Security Scan
on:
push:
branches: [ main ]
workflow_dispatch:
jobs:
vulnfy:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install Vulnfy
run: pip install git+https://github.com/wxwreak/vulnfy.git
- name: Run Vulnfy Scanner
env:
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
run: vulnfy --fail-on high
Configuration & Alerts
Want to hook it up to Telegram or Discord? Just drop a vulnfy.yaml file into your root directory:
notifications:
discord:
enabled: true # Set to true for Discord alerts
telegram:
enabled: false # Set to true for Telegram alerts
(And store your webhooks/tokens securely in Github Secrets/.env file).
🎉 Tackling Alert Fatigue: Big Updates to Vulnfy Security Scanner!
Huge thanks to the community feedback pointing out that lightweight security tools must avoid alert fatigue. Nobody wants a security scanner that pings them for every single low-severity flaw or spam notification when the codebase is clean.
Based on that feedback, I've just pushed a fresh update to Vulnfy—a lightweight, cross-platform dependency and container vulnerability scanner written in Python.
Here is what is new in this release:
1. Smart Notifications & Severity Thresholds
Notifications to Discord and Telegram are now completely customizable. Vulnfy will only send alerts when vulnerabilities match or exceed your configured threshold (e.g., --fail-on medium or high), completely eliminating spam.
2. Multi-Format Reporting
Beyond the default JSON, Vulnfy now natively supports exporting your scan reports into:
- 📄 HTML (with custom styling support)
- 📝 Markdown
- 📊 CSV
- ⚙️ YAML
- 📑 PDF (via HTML templates)
3. Vulnerability Suppression (.vulnignore)
Got a false positive or a vulnerability you can't fix right this second? Just add the CVE or ID to a .vulnignore file in your root directory. Ignored items won't trigger CI failures or spam your chat channels.
4. CLI Enhancements (--no-cache)
Added the --no-cache argument to keep your workspace clean and prevent Python from generating unnecessary __pycache__ and bytecode files during scans.
Give it a Try!
Vulnfy is completely open-source, and i'm actively working on improving it.
- Check out the repo on Github:
⭐️
- Let me know what you think in the comments below!
Top comments (5)
A lightweight scanner earns trust when it is easy to run often and hard to ignore when it finds something real. The key is making the output actionable enough that CI failures do not turn into alert fatigue.
Spot on feedback. You're absolutely right, making a tool 'actionable' is the only way to avoid alert fatigue.
I’ve just pushed an update to address exactly what you suggested:
Thanks for the push to make the tool more production-ready!
That is exactly the right direction. A vulnignore file is useful only if it is visible enough to review later, and threshold-based CI failures help keep the tool from becoming background noise. The next thing I would watch is whether ignored items carry an owner or expiry date, otherwise permanent exceptions tend to become a second vulnerability list.
Thanks! That's actually a brilliant point about expiration dates and owners. Right now,
.vulnignoreis intentionally kept simple (just a plain list of IDs to avoid cluttering small projects), but adding something like owners or review-by dates for larger enterprise codebases is a great concept to prevent permanent blind spots. Definitely keeping that in mind for future improvements!A simple file is good for a small project. When the exception list becomes operationally important, the key is making every entry reviewable: why it exists, who owns the risk, and when it should be reconsidered. Otherwise the list becomes a quiet permanent allowlist.