Dependency Scanning¶

SentriKat Dependency Scanning analyzes the libraries and dependencies of your software projects to find known vulnerabilities (CVE, GHSA). Results are shown in the SentriKat dashboard with severity, available fixes, and EPSS score.

Supported Ecosystems¶

How to Use It¶

Option 1: Standalone Scanner (recommended for developers)¶

The standalone scanner requires only Python 3.7+ and has no additional dependencies.

# Install the scanner
pip install sentrikat-scan

# Initialize in your project
cd /path/to/my-project
sentrikat-scan --init

# Run a scan
sentrikat-scan

# Install Git hook (automatic scan before every commit)
sentrikat-scan --install-hook

Option 2: CI/CD Pipeline¶

Integrate dependency scanning directly into your CI/CD pipeline. The scanner exits with a non-zero code when vulnerabilities above the configured severity are found.

- name: Security scan
  run: |
    pip install sentrikat-scan
    sentrikat-scan --fail-on high
  env:
    SENTRIKAT_SERVER: ${{ secrets.SENTRIKAT_URL }}
    SENTRIKAT_API_KEY: ${{ secrets.SENTRIKAT_API_KEY }}

security_scan:
  image: python:3.11
  script:
    - pip install sentrikat-scan
    - sentrikat-scan --fail-on high
  variables:
    SENTRIKAT_SERVER: $SENTRIKAT_URL
    SENTRIKAT_API_KEY: $SENTRIKAT_API_KEY

stage('Security Scan') {
    steps {
        sh 'pip install sentrikat-scan'
        sh 'sentrikat-scan --fail-on high'
    }
    environment {
        SENTRIKAT_SERVER = credentials('sentrikat-url')
        SENTRIKAT_API_KEY = credentials('sentrikat-api-key')
    }
}

The pipeline fails automatically if vulnerabilities with severity HIGH or above are found.

Option 3: Agent on Server/VM¶

The SentriKat agent installed on Linux/macOS/Windows servers automatically scans dependencies of projects present on the machine every 4 hours.

Requires an API key with scan_dependencies enabled. See Extension & Dependency Scanning for agent configuration details.

What Gets Checked¶

• Exact versions of installed libraries (not ranges) — parsed from lockfiles
• Cross-referenced with Google's OSV.dev database (CVE, GHSA, PYSEC, RUSTSEC)
• Direct vs. transitive dependency distinction
• Available fixes with recommended target version

Dashboard View¶

Once scan results are submitted, the SentriKat dashboard shows:

Requirements¶

• Python 3.7+ for the standalone scanner
• API key with scan_dependencies permission
• HTTPS connectivity to the SentriKat server

Limitations¶