Integrate Coinbase Salus with Vulnetix. Run Salus to coordinate multiple security scanners (Brakeman, npm audit, Bundler Audit, and more) in a single Docker command and export JSON findings.
Install & scan
$ docker pull coinbase/salus $ docker run --rm -v $(pwd):/home/repo coinbase/salus # Output is written to salus_report.json in the mounted directory
Run Coinbase Salus in CI
Scan on every push and upload the report as a workflow artifact:
- name: Run Salus security scan
run: |
docker run --rm -v ${{ github.workspace }}:/home/repo coinbase/salus
- name: Upload to Vulnetix
run: vulnetix upload --file salus_report.json
How Vulnetix compares: better together
Vulnetix does not replace Coinbase Salus. Keep running it. Vulnetix sits on top of Coinbase Salus (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Coinbase Salus is strongest at its core category and also carries features in SCA, Secret Scanning, just as Vulnetix spans categories.
| Capability | Vulnetix | Coinbase Salus |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✓ Runs Semgrep, Brakeman (Rails) and Gosec (Go) for static code analysis |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Runs bundler-audit and npm/yarn audit for dependency CVEs |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ Bundles TruffleHog for leaked-credential detection, plus PatternSearch (sift) for configured anti-patterns |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ~ Coordinates scanners and compiles output into a single report, but this is aggregation, not cross-scanner dedup or risk prioritisation |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Coinbase Salus does well
- One-line Docker orchestration: auto-detects project type and runs all applicable scanners so teams get security scanning without wiring up each tool
- Bundles battle-tested open-source engines (Semgrep, Brakeman, Gosec for SAST; bundler-audit, npm/yarn audit for SCA; TruffleHog for secrets) behind a single config
- Compiles heterogeneous scanner output into one unified report, ideal for consistent CI enforcement across many repos
- Open-source, extensible and CI-native: proven at Coinbase scale for enforcing security policy on every change
Where Vulnetix adds to it: Salus and Vulnetix share the 'coordinator' DNA, but Salus stops at aggregating raw scanner reports. Vulnetix takes that consolidated output further: true cross-scanner dedup into one prioritised queue, exploit-intel scoring (EPSS/KEV/ESS/LEV), reachability, versioned VEX, Safe Harbour autofix, EOL and SSVC policy, so Salus can even be one of the upstream engines whose output Vulnetix ingests and enriches.
No migration, no rip-and-replace. Coinbase Salus keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Coinbase Salus results in Vulnetix
Upload Coinbase Salus JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.