vulnerability scan of OSS source code

[ahuan2616]

Does osv-scanner support vulnerability scan of OSS source code?
By reading the documentation and testing, I think it is not supported, but I would like to do a double confirm, thanks !

[oliverchang]

Hi, can you clarify what you mean?

This scanner currently focuses on scanning the dependencies in a project, by scanning for e.g. lockfiles and package manifest files rather than scanning source code directly.

We do have plans to combine this with some source code analysis (#11), with vendored code detection for C/C++ source code.

[ahuan2616]

Hi Oliver,
Thank you for your detailed explanation! You have answered my questions.
My question is whether osv-scanner can support source code analysis，such as C/C++ that using open source files.

[oliverchang]

Great! you can follow #82 and the linked issues there for C/C++ progress.

[ahuan2616]

OK, I will follow #82, and thanks for sharing a powerful tool, and it would be great if it could support source code analysis.