Dependency Scanning¶

SentriKat Dependency Scanning analyzes the libraries and dependencies of your software projects to find known vulnerabilities (CVE, GHSA). Results are shown in the SentriKat dashboard with severity, available fixes, and exploit probability.

Supported Ecosystems¶

How to Use It¶

Option 1: Standalone Scanner (recommended for developers)¶

The standalone scanner requires only Python 3.7+ and has no additional dependencies.

# Install the scanner
pip install sentrikat-scan

# Initialize in your project
cd /path/to/my-project
sentrikat-scan --init

# Run a scan
sentrikat-scan

# Install Git hook (automatic scan before every commit)
sentrikat-scan --install-hook

Option 2: CI/CD Pipeline¶

Integrate dependency scanning directly into your CI/CD pipeline. The scanner exits with a non-zero code when vulnerabilities above the configured severity are found.

- name: Security scan
  run: |
    pip install sentrikat-scan
    sentrikat-scan --fail-on high
  env:
    SENTRIKAT_SERVER: ${{ secrets.SENTRIKAT_URL }}
    SENTRIKAT_API_KEY: ${{ secrets.SENTRIKAT_API_KEY }}

security_scan:
  image: python:3.11
  script:
    - pip install sentrikat-scan
    - sentrikat-scan --fail-on high
  variables:
    SENTRIKAT_SERVER: $SENTRIKAT_URL
    SENTRIKAT_API_KEY: $SENTRIKAT_API_KEY

stage('Security Scan') {
    steps {
        sh 'pip install sentrikat-scan'
        sh 'sentrikat-scan --fail-on high'
    }
    environment {
        SENTRIKAT_SERVER = credentials('sentrikat-url')
        SENTRIKAT_API_KEY = credentials('sentrikat-api-key')
    }
}

The pipeline does not fail on its own. --fail-on defaults to nothing, and you choose the level when you initialise the configuration: none, critical, high, medium or low.

The templates SentriKat generates for CI and for pre-commit propose --fail-on critical, which is the level worth arguing about: a build that breaks on low is a build people learn to bypass.

Option 3: Agent on Server/VM¶

The SentriKat agent installed on Linux/macOS/Windows servers automatically scans dependencies of projects present on the machine every 4 hours.

Requires an API key with scan_dependencies enabled. See Extension & Dependency Scanning for agent configuration details.

What Gets Checked¶

• Exact versions of installed libraries (not ranges), parsed from lockfiles
• Cross-referenced with Google's package advisories database (CVE, GHSA, PYSEC, RUSTSEC)
• Direct vs. transitive dependency distinction
• Available fixes with recommended target version

Dashboard View¶

Once scan results are submitted, the SentriKat dashboard shows:

Requirements¶

• Python 3.7+ for the standalone scanner
• API key with scan_dependencies permission
• HTTPS connectivity to the SentriKat server

Limitations¶