BreachScope

Supply-chain and toolchain breach scanner for release evidence

Local-first CLI and dashboard that scans source, dependencies, lockfiles, live URLs, SaaS toolchains, and Docker attack paths. Outputs SARIF, SBOM, OpenVEX, policy decisions, and triage-ready evidence for release gates.

Capabilities

Dependency and OSV matching

Static code audit patterns

Docker sandbox attack probes

Live header and path checks

SARIF / CycloneDX / SPDX / OpenVEX outputs

Policy-as-code, baselines, and triage

Architecture

CLI-first scanner with optional dashboard for project history, scoped API keys, policy packs, integrations, and audit logs. Depth modes from direct manifests to recursive dependency graphs.

Technology stack

TypeScriptNode.jsSARIFCycloneDXSPDXOpenVEXDocker

Use cases

CI release gates

AppSec triage workflows

SBOM and VEX evidence packs

Supply-chain risk scoring

Discuss BreachScope

Share constraints, integrations, and timeline. We will map architecture and delivery options.

Contact engineering Open workspace

Loading…