Skip to main content
All software
VISaR logo

VISaR

Vulnerability Identification, Scanning & Reporting

Open SourceApache 2.0OSSF Scorecard + OSV

A free, open-source command-line tool that scans GitHub repositories against known vulnerability databases - built for data platform teams who need a repeatable evidence record before approving open-source dependencies.

View on GitHubBook a free consultation
visar_dashboard.html
VISaR interactive vulnerability dashboard - severity filters, scan selector, and expandable findings

One file. Every scan. No server, no setup. VISaR v1.1.0 rolls every scan in your data/ directory into a single self-contained HTML dashboard. Filter by severity, switch between scans, and expand any row for full detail - all in one file you can email or share.

The problem

Most of your codebase is code you didn’t write.

“VISaR gave us an evidence trail that cut approval times for new technologies from weeks to days.”
Program Manager, UK Defense

Every open-source library you pull in, along with every dependency it brings with it, is a potential entry point into your data platform. In regulated environments, “we think it’s fine” isn’t an answer an auditor accepts, and AI assistants now generate dependency choices faster than anyone can vet them by hand.

VISaR turns that vetting into a single, repeatable command that takes a minute or two. Point it at a repository and get back a structured, severity-rated report you can keep as evidence. Every dependency approval is backed by the same check, run the same way, every time.

It started when a client asked how to quantify their open-source risk. We built VISaR for our own client work, and we run it on every platform we deliver.

How it works

From a repo URL to an evidence record - in four steps.

  1. 01

    Point it at a repository

    Give VISaR any public GitHub URL or a text file of them for batch mode. OSSF Scorecard scans the project and surfaces its known vulnerabilities.

  2. 02

    Findings are enriched via OSV

    Each vulnerability ID is sent to the OSV database to pull back severity ratings, plain-text descriptions, and aliases, so a raw ID becomes a decision you can act on.

  3. 03

    A structured report is written

    Results are compiled into a clean CSV or JSON file, named by date and repository. Open it in Excel, diff it in version control, or feed it into your own pipeline.

  4. 04

    Consolidate into one dashboard

    Roll every scan into a single self-contained HTML dashboard. Filter by severity, switch between scans, expand rows for full detail, then email it or drop it in a shared drive.

Under the hood, VISaR leans on best-in-class open source: the OSSF Scorecard for identification and the OSV database for enrichment. Output is available as CSV, JSON, or the interactive HTML dashboard above.

Who it’s for

Built for teams that have to prove what they scanned.

Data Engineers & Platform Teams

Evaluate open-source libraries before they enter your data stack. Keep VISaR's structured output as your evidence record, version-controllable and auditor-ready.

Software Engineers

Validate your own codebase before a release. Confirm your dependency graph carries no known vulnerabilities into the milestone you're shipping.

Independent Developers

Got an AI-generated dependency you're not sure about? Run it through VISaR first, a fast, objective check before it lands in your codebase.

Quick start

Up and scanning in under 5 minutes.

Clone, sync dependencies with uv, complete a one-time setup, and point VISaR at any public GitHub repository.

  • Python 3.12+ (managed automatically by uv)
  • Docker Desktop (2 GB available memory)
  • GitHub personal access token with public_repo scope
  • Network access to api.github.com and api.osv.dev

Current limitations

  • Public GitHub repositories only (private repos are not supported yet).
  • Batch scans run sequentially (one repository at a time).
  • Docker Desktop must be running before a scan.
terminal
# 1. Clone and syncgit clone https://github.com/AtLongLastAnalytics/visarcd visaruv sync# 2. One-time setupcp .env.example .env# set VISAR_AUTH_TOKEN in .envdocker pull gcr.io/openssf/scorecard:stable# 3. Scan a single repository (writes CSV to data/)uv run visar https://github.com/matplotlib/matplotlib# 4. Batch scan from a listuv run visar --batch repos.txt# 5. Build the interactive dashboarduv run visar-dashboard          # writes data/visar_dashboard.html# Want to look first? Preview with the bundled example data:uv run visar-dashboard examples

FAQ

Common questions.

How is VISaR different from Dependabot or Snyk?
Those tools continuously monitor code you own. VISaR is built for the step before that: vetting a third-party repository before you approve it, and keeping a dated, severity-rated evidence record of that decision for auditors.
Can we use VISaR commercially?
Yes. VISaR is released under the Apache 2.0 license, which explicitly permits commercial use, modification, and redistribution. You can run it in your automated build pipelines, deploy it inside your organization, and incorporate its outputs into commercial compliance workflows. The license stays with the open-source project; any custom features we build for you are negotiated separately.
What does a customization engagement look like?
Typical engagements start with a free consultation to scope the gap between the free version of VISaR and what your environment needs. Common asks are private deployment inside a security boundary, integration with internal ticketing or compliance systems, custom severity thresholds for CI gates, support for private and GitLab/Bitbucket repositories, and bespoke report formats. We then agree a fixed-scope build, deliver, document, and hand over. Most engagements are 2-6 weeks.
Do we own the custom features we pay for?
Both are options and we agree this upfront. The default is: anything that benefits the wider community gets upstreamed under Apache 2.0; anything that's organization-specific (your internal ticketing integration, your compliance schema mappings) stays in your private fork. We never lock you in. You get the source, the runbook, and the ability to maintain it yourselves.
Do you offer support contracts for the free open-source version?
We offer light-touch support engagements for teams running the free version of VISaR in production, including monthly check-ins, scan-output reviews, escalation help, and upgrade guidance. If you're integrating VISaR into a regulated audit workflow and want a named engineer behind it, get in touch.

Private deployments and custom features.

We deploy VISaR inside your security boundary and extend it for your stack and compliance needs.

Discuss a private deploymentEmail us

Release notes & background

From the blog.

All articles
Our SoftwareMar 26, 2026

VISaR v1.1.0: Batch Scanning and Interactive Dashboard

VISaR v1.1.0 adds batch scanning across multiple repos and a self-contained HTML dashboard for sharing results. No server, no setup, just a file your team can open and explore.

7 minRead
Our SoftwareMar 12, 2026

VISaR: A Code Scanning Tool for Data Platform Engineers

VISaR is a free, open-source tool for scanning GitHub repositories against known vulnerability databases. Built after a client asked how to quantify their open-source risk.

4 minRead