Respond to Vulnerabilites

RV.1.1: Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.

RV.1.2: Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

RV.1.3: Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy.

Scans source trees and manifest/lock files against OSV for known vulnerabilities for discovery early in development.

Continuously synchronizes Software Bill of Material versions of built artifacts to OSV.dev reporting on vulnerabilities discovered post-build.

Rule-based SAST in PRs/CI for previously undetected vulnerabilities. Static analysis tool used for searching code, finding bugs, and enforcing code standards at various stages of the development cycle (editor, commit, and continuous integration - CI). 

SCA for many ecosystems; runs in CI, outputs SARIF/HTML. CVE-based dependency matching for code-time feedback.

Can source/lockfiles and IaC before build. All-in-one SCA + IaC misconfig checks pre-build.

Generate SBOMs (CycloneDX/SPDX) directly from source. Composition/provenance data to power RV.1 discovery.

Scan source directories or Software Bill of Materials (from Syft) for vulnerabilities. Accurate matching via SBOM + flexible CI integration.

Developers can continuously inspect code quality to detect bugs, code smells, and security vulnerabilities without executing the code.

Developed by GitHub, developers and security researchers can analyze codebases for security vulnerabilities, bugs, and other code quality issues.

A static analysis tool designed to identify common security vulnerabilities in Python code.

Vulnerability scanner specifically designed for Ruby on Rails applications.

Static code analysis tool designed for Java applications, used to identify potential security vulnerabilities within the code.

Prevent hardcoded secrets in code and configs.

Conftest is a utility to help you write tests against structured configuration data.

RV.2.1: Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.

RV.2.2: Plan and implement risk responses for vulnerabilities.

Aggregates SBOMs, attestations, and vulns to understand blast radius and prioritize fixes.

Automates dependency upgrades/patch PRs with risk-aware policies.

Ingest scanner results (Semgrep/Grype/Trivy/etc.) for de-dupe, severity, ownership, and workflow. Central vulnerability triage and risk tracking tied to repos.

Exposes the blast radius of each vulnerability across live environments.

Agentless vulnerability scanner that analyzes installed packages and maps to CVE data with CVSS scoring. Provides severity, exploitability, and remediation recommendations; can integrate with patch workflows.

Continuous SBOM-based component analysis platform. Enriches vulnerabilities with metadata (severity, exploitability, policy impact).

VEX bridges the gap between identifying potential vulnerabilities (SBOM) and determining their actual risk in a specific environment. Allows organizations to prioritize remediation efforts by focusing on vulnerabilities that are truly exploitable and require immediate attention.

RV.3.1: Analyze identified vulnerabilities to determine their root causes.

RV.3.2: Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.

RV.3.3: Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external reports.

RV.3.4: Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or in new software that is created.

Maintains a “guardrail” ruleset for historical issues. Provides pattern-class eradication across modules.

Encode RCAs as rules (e.g., ban insecure APIs, enforce sanitizers) and run in PRs. Catches the class of bug that caused the incident.

Monitor repo hygiene signals (Branch protection, dependency-pinning, fuzzing, etc.) and bake improvements into SDLC. Preventative controls aligned to root-cause themes.

Query codebases to trace vulnerability origins (e.g., find all injection points).

Identifies code quality/security rule violations that may indicate systemic coding issues.

Aggregates scanner results so patterns in vulnerability types are easier to spot.

Tracks vulnerable components and shows recurring dependency-related issues.

A vulnerability scanner for container images and file systems.

Correlates SBOMs across releases to identify repeated dependency issues.

Language-specific security scanner to identify same flaw across multiple files.

Finds repeated insecure coding practices in Rails apps.

Enforces code quality/security hooks before commits.

Git hook automation for JavaScript/TypeScript projects to enforce checks.

Prevents misconfigurations from being deployed by embedding into existing developer workflows.

Adds IaC guardrails to prevent insecure configurations at commit time.

Finds security vulnerabilities, compliance issues, and infrastructure misconfigurations.