GeezerVison

Security advisories your scanner can't see yet.

When maintainers publish a security advisory in their GitHub repository, it doesn't reach the GitHub Advisory Database or OSV until GitHub reviews it. Dependabot, npm audit, OSV-Scanner and most dependency scanners read those databases, so they stay silent in the meantime, often for weeks. The advisory is public and usually already fixed, but it's in limbo.

Limbowatch measures that gap in the open and closes it in CI.

# GitLab CI/CD
include:
  - component: $CI_SERVER_FQDN/limbowatch/limbowatch-component/[email protected]

# GitHub, Gitea or Forgejo Actions
- uses: limbowatch/[email protected]
  with:
    fail-on: high

# Anywhere else
docker run --rm -v "$PWD:/src" ghcr.io/limbowatch/limbowatch:0.1.0a13 limbowatch scan .
pipx install limbowatch-cli==0.1.0a13

The action is in GitHub Marketplace and the component in the GitLab CI/CD Catalog. Releases are alphas: options and formats may change before 0.1.0.

Source · Documentation · Methodology · GitHub Marketplace · GitLab CI/CD Catalog · PyPI · Security policy · Press

Open source under Apache-2.0. Research data and the feed are CC BY 4.0. Advisory data comes from GitHub repository security advisories and the GitHub Advisory Database (CC BY 4.0).