Your real attack surface isn't just the code you wrote - it's the deep tree of dependencies you pulled in, and their dependencies, any of which might carry a known, published vulnerability. OSV-Scanner is Google's tool for finding those. It reads the lockfiles you already have, resolves the exact versions you actually ship, and checks every one against the OSV database - the open, aggregated source of vulnerability data spanning many ecosystems.
Scans the Lockfiles You Already Have
Because it works from lockfiles, it sees the precise resolved versions rather than loose version ranges. Point it at a project and it discovers and scans them automatically:
# Scan a whole project recursively
osv-scanner scan --recursive .
# Or a specific lockfile
osv-scanner scan --lockfile composer.lock
Backed by the OSV Database
OSV aggregates advisories across ecosystems - Composer/Packagist, npm, PyPI, Go, and more - into one machine-readable format, so a single scanner covers a polyglot project instead of one tool per language. Matches come back with the advisory, the affected range, and where the vulnerable package sits in your tree.
A CI Gate for Dependencies
It's a single binary with machine-readable output, which makes it a natural check to run in CI (or a pre-deploy step) so a newly-disclosed vulnerability in a dependency fails the build rather than shipping quietly.
Rough Edges and Limitations
- Known vulnerabilities only. It finds what's been disclosed and cataloged - not novel or unreported issues.
- Not every finding is reachable. A flagged package may sit in code your app never calls; triage matters.
- Fixing means updating. Detection points at the problem; you still have to bump or patch the dependency.
- Lockfiles required. The precise scan needs a lockfile; loose manifests give weaker results.
For any project with a dependency tree - which is all of them - OSV-Scanner is a low-effort, high-value check that turns "we didn't know that library had a CVE" into something you catch on purpose.
Internal link suggestion: link "known vulnerability" to the Trivy or Gitleaks post to build out a security-scanning toolkit.