Awesome Reviewers

Verification · Supply chain

Dependency audit

Matches dependencies against advisory databases and license policy, and fails on known-vulnerable or disallowed packages.

Sub-techniques

  • Advisory matching V1015.001

    Compare resolved versions with OSV, GitHub and ecosystem advisories.

  • Reachability-aware audit V1015.002

    Report a vulnerable dependency only when the vulnerable function is called.

  • License policy V1015.003

    Allow or deny dependencies by license.

How to build it

  1. Run an audit on every manifest or lockfile change and on a daily schedule.
  2. Fail on high severity with a fix available; warn on the rest.
  3. Use a reachability-aware tool where the ecosystem has one.

Signals in a repository

  • deny.toml, osv-scanner.toml, a dependency-review workflow or an audit script.
  • Dependabot or Renovate config with security updates enabled.