code.grypegrype vulnerability scan
Scans the directory with Anchore grype (builds an SBOM with syft, matches against the grype database). Overlaps osv-scanner and trivy, so it is opt-in. Runs from a scratch directory so project-level grype config is ignored; the vulnerability database is downloaded on first use.
- Engine
- Wrapped scanner
- Wraps
grype- Targets
- Codebase
- Areas
- Supply chain, Security
- Runs
- Opt-in: only when selected with --only
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit . --only code.grypeWraps grype. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.