Vulnyard

Every GitLab repository scanned. Nothing added to them.

Vulnyard centrally scans your GitLab groups and projects with Trivy, uploads CycloneDX SBOMs to Dependency-Track and gives DevOps one dashboard for the whole organisation - no pipelines, no merge requests.

Get started View on GitHub

Open source · Apache-2.0

  1. GitLabgroups and projects, self-hosted or gitlab.com
  2. Trivyshallow clone, CycloneDX SBOM
  3. Vulnyardschedules, targets, rules
  4. Dependency-Trackvulnerability analysis and metrics
  5. Dashboard & chatoverview, trends, notifications
01

Zero footprint in your repositories

No CI jobs to add, no merge requests to approve, no config files to maintain in hundreds of projects. A read-only token is all Vulnyard needs.

02

The whole organisation at a glance

New repositories in a scanned group are picked up automatically. Answer “where do we have CVE-XXXX?” across every project in seconds.

03

Built on open standards

Trivy for SBOMs, CycloneDX as the format, Dependency-Track for analysis. Your data stays in tools you already know and can keep using.

Features

What Vulnyard does for you

Everything you need to keep track of vulnerable dependencies across a large GitLab - and to make sure the right people hear about them.

Scan targets

A whole GitLab group (with subgroups) or a single project. Pick branches, a cron schedule, exclusions - and optionally a GitLab instance and token of its own.

Efficient scanning

Shallow clone, Trivy, CycloneDX SBOM, upload to Dependency-Track. Projects whose commit has not changed since the last scan are skipped.

Dashboard

Summaries by severity, 30/90/180-day trends, the riskiest projects, project detail with findings and history, and vulnerabilities across projects.

Chat notifications

Findings, improvements and broken scans go to Google Chat - one thread per repository, with what changed since the last scan and who maintains it.

Ignoring vulnerabilities

Suppress a finding for one target or everywhere, for selected components only and until a given date. The analysis is written to Dependency-Track too.

Operations

Run history with errors per job, manual runs and cancelling, a built-in scheduler, history retention and connection tests in Settings.

REST API with tokens

Everything in the UI is in the API, documented with OpenAPI. Read-only or read-write tokens let other systems create scan targets on their own.

Multilingual

English and Czech out of the box. Another language is two translation files away - no code needed.

How it works

From repository to dashboard

Each project and branch becomes one job in a queue. Clones are deleted right after the scan and nothing is ever written back to GitLab.

  1. Discover

    For every scan target Vulnyard lists projects and branches through the GitLab API - new repositories in a group are found on their own.

  2. Generate the SBOM

    A shallow, single-branch clone is scanned by Trivy, which produces a CycloneDX software bill of materials.

  3. Analyse in Dependency-Track

    The SBOM is uploaded to Dependency-Track, which keeps analysing it - a newly published CVE shows up even without a new scan.

  4. Act on it

    The dashboard turns the findings into an overview for the whole organisation, and chat notifications reach the repository maintainers.

Quick start

Running in a few minutes

Every release is published as a multi-arch container image (linux/amd64, linux/arm64). A server needs only docker-compose.yml and .env.

  • Docker with Compose
  • GitLab - self-hosted or gitlab.com - and a group token with the Reporter role (read_api, read_repository)
  • Dependency-Track 4.12 or newer and a team API key
  • PostgreSQL - bundled in the Compose file
shell 
# the release to run
VERSION=X.Y.Z
mkdir vulnyard && cd vulnyard
curl -fsSLO https://raw.githubusercontent.com/oldsch00ler/vulnyard/v$VERSION/docker-compose.yml
curl -fsSL -o .env https://raw.githubusercontent.com/oldsch00ler/vulnyard/v$VERSION/.env.example
# fill in .env, set POSTGRES_PASSWORD and
# VULNYARD_IMAGE=ghcr.io/oldsch00ler/vulnyard:$VERSION
docker compose pull
docker compose up -d --no-build

The application then runs on port 8000. No Dependency-Track yet? The repository’s Compose file can start one locally - see the README. Vulnyard does not sign anyone in by default, so keep it behind a VPN or an authenticating proxy.

Open source

Free to use, open to contributions

Vulnyard is licensed under Apache-2.0. Bug reports, ideas, translations and pull requests are welcome. Found a security issue? Please report it privately as described in the security policy.