Features and capabilities
OSV intelligence and CycloneDX scanning
Verified flow from vulnerability-data synchronization to SBOM components and findings.
OSV ingestion
Managed sources provide full/incremental synchronization, leases, checkpoints, progress, retries, and item-level failure details.
CycloneDX scanning
An SBOM is projected into components, dependency edges, and findings within organization, project, and environment context.
OSV source lifecycle
Source connectivity and full synchronization establish the initial dataset; incremental synchronization resumes from a checkpoint. A PostgreSQL lease limits concurrent processing of the same source across replicas. Counters, cursor, retries, and item-level failures are tracked through the task.
Scan input and output
Accepted input is a CycloneDX SBOM with required organization, project, and environment context. The raw input is linked by checksum; normalized components, dependency edges, OSV matches, and applicable policy evaluation are retained as separate records.
- Traceable checksum, component count, and dependency count when the same input is run again
- Distinct results for matched and unmatched components
- Association of finding severity and source-advisory context with the policy result
- Historical scans not being silently rewritten by later intelligence updates
Validation and failure boundaries
Malformed or unsupported SBOM input must produce a validation result; an item-level OSV failure must not let the entire task appear successful without evidence. A current vulnerability match does not replace product-version context, organizational risk decisions, or independent assurance.