SHSelfHostIndex
OS

OSV-Scanner

Vulnerability scanner backed by the OSV database

Developer Tools & Git ★ 11.2k stars Easy setup Apache-2.0

OSV-Scanner is an open-source tool from Google that scans project dependencies for known vulnerabilities using the Open Source Vulnerabilities database. It runs locally and in self-hosted CI pipelines.

Official siteSource code

Key features

  • OSV database backed
  • Lockfile scanning
  • SBOM input support
  • CI friendly

Strengths

  • Released under the Apache-2.0 license
  • Easy to set up — beginner-friendly
  • First-class Docker support for quick deployment
  • Mature project with 11.2k GitHub stars

Is OSV-Scanner secure?

OSV.dev has no published security advisories for OSV-Scanner's repository. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

Source: OSV.dev, checked 2026-10-14. How this is measured.

OSV-Scanner replaces

Self-hosted Snyk alternativesSelf-hosted Dependabot alerts alternatives

Health badge

Maintain OSV-Scanner? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 93 · excellent

Markdown
[![SelfHostIndex health score for OSV-Scanner](https://selfhostindex.com/badge/osv-scanner.svg)](https://selfhostindex.com/app/osv-scanner/)
HTML
<a href="https://selfhostindex.com/app/osv-scanner/"><img src="https://selfhostindex.com/badge/osv-scanner.svg" alt="SelfHostIndex health score for OSV-Scanner"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/osv-scanner.svg
   :alt: SelfHostIndex health score for OSV-Scanner
   :target: https://selfhostindex.com/app/osv-scanner/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare OSV-Scanner

4 head-to-head comparisons.

Similar developer tools & git apps