Vulnerability Scanning

RepoFlow scans supported package versions for known vulnerabilities and shows the detected CVEs with severity and advisory details.

Supported package types

npmDockerMavenPyPINuGetGoHelmRPMDebianComposerGemsCargoChocolatey

At a glance

• Available for: local and remote repositories when vulnerability scanning is enabled.
• Results include: severity counts, CVE identifiers, affected package details, and advisory links.
• Use with: download rules to block vulnerable packages or versions.
• RepoFlow Cloud: scanning infrastructure is managed for you.

Use vulnerability scanning

1. Open a supported package and select its Vulnerabilities tab.
2. Select a package version to review its latest scan status and findings.
3. Inspect each CVE’s severity and advisory information before deciding whether to upgrade, remove, or restrict the version.
4. If you need enforcement, create a version download rule using CVE or severity-count conditions.

Results are version-specific. A package can contain both affected and unaffected versions, so check the version your application actually consumes.

API and self-hosting

Use the Get Version Vulnerabilities API to retrieve the latest scan summary and CVE details programmatically.

Self-hosted RepoFlow uses a bundled Grype scanner. See Vulnerability Scanning Configuration for resource usage, database updates, scheduled scanning, and air-gapped deployments.

Review severity totals and each affected dependency for an npm package.