Vulnetix
Try Vulnetix Request Demo

One scanning tool. Comprehensive coverage.

You shouldn't need eleven tools to answer one question: is this code safe to ship? SCA, SAST, secrets detection, IaC, containers, licenses, SBOM, VEX, and security reporting from a single command. Runs locally, inside AI coding agents, or in any CI pipeline.

Get Free API Key

35+ Ecosystems 55+ Manifest Formats 2995+ Static Rules

The category silo problem

Somewhere along the way, product security became eleven different procurement conversations. It was always one job: tell the developer what to fix before shipping. The Vulnetix Code Scanner collapses SCA, IaC, container, license, SBOM, VEX, secrets, SAST, quality linting, reporting, and coding-agent security into a single vulnetix scan command with one severity scale, one finding store, and one compliance report.

All scanner categories, one command

Nine of these have a page of their own: software composition analysis, SAST, container scanning, secrets scanning, infrastructure as code scanning, licence compliance, malware scanning, the AI bill of materials and the cryptography bill of materials. The rest are produced by the same run and covered further down.

SCA

Software Composition Analysis

Identify every direct and transitive dependency across 35+ ecosystems. Match installed versions against known vulnerabilities with multi-source severity scoring.

  • Direct & transitive detection
  • Version-range matching
  • CVE/GHSA correlation
  • Scope-aware analysis
IaC

Infrastructure as Code

Scan Terraform configurations, Dockerfiles, GitHub Actions workflows, Bazel workspaces, and Buck build files for misconfigurations and vulnerable references.

  • Terraform provider/module versions
  • GitHub Actions pinning
  • Bazel & Buck dependencies
  • HCL & Starlark parsing
Containers

Container Scanning

Parse Dockerfile and Containerfile FROM directives to identify base image vulnerabilities. Track every layer of your container supply chain.

  • Base image detection
  • Multi-stage build support
  • Containerfile parsing
  • Registry-aware lookups
Licenses

License Compliance

Automatically detect SPDX license identifiers across all dependencies. Flag restricted, copyleft, and proprietary licenses before they reach production.

  • SPDX license detection
  • GPL/AGPL flagging
  • Inclusive compliance mode
  • Per-package classification
SBOM

SBOM Generation

Produce CycloneDX Software Bills of Materials in versions 1.2 through 1.7. Every scan outputs a complete, machine-readable inventory of your software supply chain.

  • CycloneDX 1.2-1.7
  • SPDX 2.3 import
  • Package URL (purl)
  • Lifecycle & tools metadata
Secrets

Secrets Detection

Detect hardcoded credentials, API keys, tokens, and private keys committed to source files. Built-in Rego rules cover AWS access keys, GitHub tokens, private keys, and more.

  • AWS access key detection
  • GitHub & GitLab tokens
  • Private key scanning
  • Configurable rule severity
SAST

Static Application Security Testing

Evaluate source files against Rego-based security rules to catch code-level flaws. Covers injection, insecure deserialization, weak cryptography, unsafe DOM manipulation, prototype pollution, and more across nine languages.

  • 2995+ built-in rules
  • CWE / CAPEC / ATT&CK mapped
  • SARIF 2.1.0 output
  • Custom rule repos via --rule
  • gosec / trivy / regula / ruff packs
Quality

Code Quality Linting

Surface supply-chain hygiene issues that signal real risk: missing lock files, unpinned Docker base images, missing USER directives, open Spring actuator endpoints, and Django debug mode enabled in production.

  • Missing lock file detection
  • Dockerfile best practices
  • Framework misconfiguration
  • Language-aware rule sets
Agents

AI Coding Agent Integration

Built from the ground up for AI coding agents. Runs as a tool call inside the agent loop: add a dependency, scan it, get structured feedback, pick a safe version. One exit code, one JSON output.

  • Single exit code for agent gating
  • Token-efficient JSON output
  • Incremental delta scanning
  • Agentic-native design

Malware detection & package trust

Dependency confusion, typosquatting, account takeovers and malicious install scripts are not vulnerabilities in a package. They are the package. The malware engine runs in process over the dependency files already on disk, matching indicators, install script patterns and known bad artefact hashes, and it records the differentiator that produced a verdict rather than a trust score nobody can audit. Read how it decides in malware scanning.

Binary scanning

Source is not the whole supply chain, because compiled artefacts ship too. A container scan reads ELF binaries for hashes, hardening posture, dangerous capabilities and data appended past the end of the file, and recovers the packages compiled into Go, Rust and JVM artefacts. See container scanning.

Your rules. Your policy. Your code.

Vulnetix SAST, secrets, IaC, and container analysis are powered by Open Policy Agent, the CNCF-graduated policy engine. Every built-in rule is written in Rego, the same language used by Conftest, Gatekeeper, Styra, and Terraform Cloud. No proprietary DSL. No vendor lock-in.

Load your own security policy from any Git repository:

$ vulnetix scan --rule myorg/sast-rules --rule myorg/secrets-rules

2700+ ready-to-load Rego rules across community and official plugin packs. Browse the Rule Registry →

Automated SBOM & VEX evidence

Automated SBOM

Every scan outputs a complete CycloneDX Software Bill of Materials. No extra tooling, no manual assembly.

  • CycloneDX versions 1.2 through 1.7
  • SPDX 2.3 import & merge
  • Package URL (purl) for every component
  • Build lifecycle & tool attribution

VEX Attestations

VEX statements are auto-generated from real decisions. When a developer remediates a finding, the AI coding agent translates that decision into the correct VEX syntax automatically.

  • Fixed CVE: recorded as resolved
  • Under investigation: tracked as active triage
  • False positive: preserved with justification
  • Every decision creates an auditable trail

Reachability analysis: beyond "is the package installed?"

Most tools stop at the lockfile. Vulnetix also reads installed package trees, CI configuration, shell and task recipes, container images and compiled binaries, then uses tree-sitter to work out whether your code reaches the affected symbol at all. Manifest and lockfile coverage, the ecosystem list and the reachability modes are on the dependency scanning page.

Quality gates & CI integration

Combine flags to match your team's risk appetite. Runs in every major CI platform with zero configuration.

vulnetix scan --severity high --block-malware --block-eol --exploits active

Works in GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure DevOps, Bitbucket, Buildkite, Travis CI, Drone, Tekton, AWS CodeBuild, and Google Cloud Build. Zero-config manifest discovery, non-zero exit code on gate breach, SARIF output for SCA, SAST, and secrets findings.

Why teams pick Vulnetix over the alternatives

The open vuln-coordinator capability matrix catalogues 132 distinguishing capabilities across 13 sections: SCA, SAST, IaC, secrets, container, license, VEX, SSVC, supply-chain detection, and reachability. Vulnetix wins 98 of 132 (74.2%). The next-best tool, Trivy, wins 26 of 132 (19.7%). Every other tool compared scores lower still.

Supported output formats

SARIF 2.1.0 CycloneDX 1.2-1.7 SPDX 2.3 JSON VEX

Start scanning in 30 seconds

Install the CLI, get a free API key, and run your first scan. All manifest files are auto-discovered, no configuration required. The installer auto-detects OS/arch and verifies checksums.

curl -fsSL https://cli.vulnetix.com/install.sh | sh
# pin a version for reproducible CI:
curl -fsSL https://cli.vulnetix.com/install.sh | sh

Also available via brew, scoop, nix, go install github.com/vulnetix/cli/v3@latest, and the Vulnetix/cli@v3 GitHub Action. See all unattended / CI install options →

Get Free API Key →