OSV-Scanner review
A flexible OSV-based scanner for teams that can work with CLI and GitHub workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
OSV-Scanner is an open-source command-line vulnerability scanner from Google for developers and security teams. It connects project dependencies and container packages with the OSV database, covering source directories, lockfiles, SBOMs, Git repositories, and container images. Teams can run it locally, in CI/CD pipelines, or through its Go library. It fits organizations that want self-hosted scanning centered on OSV data, especially those comfortable managing CLI-based security workflows.
The published plan structure is simple: the Open source plan includes CLI and Go library usage, local and CI/CD scanning, plus source, SBOM, and container scanning. There are no paid tiers to compare. The scanner supports Windows, macOS, and Linux, and can produce JSON, SARIF, HTML, SPDX, and CycloneDX output. Its GitHub Action adds scheduled and pull-request scanning workflows, while OSV.dev supplies the vulnerability-data connection. This makes the product practical for teams already working with GitHub Actions and standard software bills of materials.
Coverage spans C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, and Rust, along with selected Alpine, Debian/Ubuntu, Ubuntu chiseled, and container package ecosystems. Container analysis includes packages and layers, and optional call analysis identifies whether vulnerable functions are executed in supported Go and Rust projects. Those capabilities give OSV-Scanner useful depth, but its integration and feature breadth are narrower than platforms built around hosted monitoring and larger ecosystem connections. Choose it for open-source, self-hosted scanning and OSV-focused workflows; consider an alternative if you need a hosted SaaS dashboard or broader integrations.
OSV-Scanner pros and cons
- Where it wins
- Scans source, lockfiles, SBOMs, containers, and vendored code
- Supports SPDX, CycloneDX, JSON, SARIF, and HTML outputs
- Adds scheduled and pull-request workflows through GitHub Actions
- Where it doesn't
- Integration coverage is narrower than broader SCA platforms
- Call analysis is limited to supported Go and Rust projects
- Uses CLI and workflows rather than a hosted SaaS dashboard
OSV-Scanner fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update