vul

README

📖 Documentation

Vul (pronunciation) is a comprehensive and versatile security scanner. Vul has scanners that look for security issues, and targets where it can find those issues.

Targets (what Vul can scan):

• Container Image
• Filesystem
• Git Repository (remote)
• Virtual Machine Image
• Kubernetes
• AWS

Scanners (what Vul can find there):

• OS packages and software dependencies in use (SBOM)
• Known vulnerabilities (CVEs)
• IaC issues and misconfigurations
• Sensitive information and secrets
• Software licenses

Vul supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page.

To learn more, go to the Vul homepage for feature highlights, or to the Documentation site for detailed information.

Quick Start

Get Vul

Vul is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:

• brew install vul
• docker run khulnasoft/vul
• Download binary from https://github.com/khulnasoft/vul/releases/latest/
• See Installation for more

Vul is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:

• GitHub Actions
• Kubernetes operator
• VS Code plugin
• See Ecosystem for more

Canary builds

There are canary builds (Docker Hub, GitHub, ECR images and binaries) as generated every push to main branch.

Please be aware: canary builds might have critical bugs, it's not recommended for use in production.

General usage

vul <target> [--scanners <scanner1,scanner2>] <subject>

Examples:

vul image python:3.4-alpine

Result

https://user-images.githubusercontent.com/1161307/171013513-95f18734-233d-45d3-aaf5-d6aec687db0e.mov

vul fs --scanners vuln,secret,config myproject/

Result

https://user-images.githubusercontent.com/1161307/171013917-b1f37810-f434-465c-b01a-22de036bd9b3.mov

vul k8s --report summary cluster

Result

FAQ

How to pronounce the name "Vul"?

tri is pronounced like trigger, vy is pronounced like envy.

Want more? Check out KhulnaSoft

If you liked Vul, you will love KhulnaSoft which builds on top of Vul to provide even more enhanced capabilities for a complete security management offering.
You can find a high level comparison table specific to Vul users here.
In addition check out the https://khulnasoft.com website for more information about our products and services. If you'd like to contact KhulnaSoft or request a demo, please use this form: https://www.khulnasoft.com/demo

Community

Vul is an KhulnaSoft Security open source project.
Learn about our open source work and portfolio here.
Contact us about any matter by opening a GitHub Discussion here Join our Slack community to stay up to date with community efforts.

Please ensure to abide by our Code of Conduct during all interactions.