Open SourceApache 2.0Python 3.12+OSSF Scorecard + OSV

VISaR

Name: VISaR
Author: AtLongLast Analytics

Vulnerability Identification, Scanning & Reporting

A free, open-source command-line tool that scans GitHub repositories against known vulnerability databases — built for data platform teams who need a repeatable evidence record before approving open-source dependencies.

View on GitHub Talk to us about customisation

The Problem

Most of your codebase is code you didn't write.

Every open-source library you pull in, along with every dependency it brings with it, is a potential entry point into your data platform. In regulated environments, “we think it's fine” isn't an answer an auditor accepts, and AI assistants now generate dependency choices faster than anyone can vet them by hand.

VISaR turns that vetting into a repeatable, ten-second command. Point it at a repository and get back a structured, severity-rated report you can keep as evidence. Every dependency approval is backed by the same check, run the same way, every time. It started with a a client asking exactly that question.

Interactive Dashboard

One file. Every scan. No server, no setup.

VISaR v1.1.0 rolls every scan in your data/ directory into a single self-contained HTML dashboard. Filter by severity, switch between scans, expand any row for the full vulnerability description — all in one file you can email, attach, or drop into a shared drive.

visar_dashboard.html

How It Works

From a repo URL to an evidence record — in four steps.

Point it at a repository

Give VISaR any public GitHub URL or a text file of them for batch mode. OSSF Scorecard scans the project and surfaces its known vulnerabilities.

Findings are enriched via OSV

Each vulnerability ID is sent to the OSV database to pull back severity ratings, plain-text descriptions, and aliases, so a raw ID becomes a decision you can act on.

A structured report is written

Results are compiled into a clean CSV or JSON file, named by date and repository. Open it in Excel, diff it in version control, or feed it into your own pipeline.

Consolidate into one dashboard

Roll every scan into a single self-contained HTML dashboard. Filter by severity, switch between scans, expand rows for full detail, then email it or drop it in a shared drive.

Under the hood, VISaR leans on best-in-class open source: the OSSF Scorecard for identification and the OSV database for enrichment. Output is available as CSV, JSON, or the interactive HTML dashboard above.

Who It's For

Built for teams that have to prove what they scanned.

Data Engineers & Platform Teams

Evaluate open-source libraries before they enter your data stack. Keep VISaR's structured output as your evidence record, version-controllable and auditor-ready.

Software Engineers

Validate your own codebase before a release. Confirm your dependency graph carries no known vulnerabilities into the milestone you're shipping.

Independent Developers

Got an AI-generated dependency you're not sure about? Run it through VISaR first, a fast, objective check before it lands in your codebase.

Quick Start

Up and scanning in under 5 minutes.

Clone, sync dependencies with uv, complete a one-time setup, and point VISaR at any public GitHub repository.

Python 3.12+ (managed automatically by uv)
Docker Desktop (2 GB available memory)
GitHub personal access token with public_repo scope
Network access to api.github.com and api.osv.dev

Current limitations

Public GitHub repositories only (private repos are not supported yet).
Batch scans run sequentially (one repository at a time).
Docker Desktop must be running before a scan.

terminal

# 1. Clone and sync
git clone https://github.com/AtLongLastAnalytics/visar
cd visar
uv sync

# 2. One-time setup
cp .env.example .env
# set VISAR_AUTH_TOKEN in .env
docker pull gcr.io/openssf/scorecard:stable

# 3. Scan a single repository (writes CSV to data/)
uv run visar https://github.com/matplotlib/matplotlib

# 4. Batch scan from a list
uv run visar --batch repos.txt

# 5. Build the interactive dashboard
uv run visar-dashboard          # writes data/visar_dashboard.html

# Want to look first? Preview with the bundled example data:
uv run visar-dashboard examples

Release Notes & Background

From the blog

All articles

AtLongLast SoftwareMar 26, 2026

VISaR v1.1.0: Batch Scanning and Interactive Dashboard

VISaR v1.1.0 adds batch scanning across multiple repos and a self-contained HTML dashboard for sharing results. No server, no setup, just a file your team can open and explore.

7 minRead

AtLongLast SoftwareMar 12, 2026

VISaR: A Code Scanning Tool for Data Platform Engineers

VISaR is a free, open-source tool for scanning GitHub repositories against known vulnerability databases. Built after a client asked how to quantify their open-source risk.

4 minRead

Common Questions

The questions teams ask before customising.

Can we use VISaR commercially?

Yes. VISaR is released under the Apache 2.0 licence, which explicitly permits commercial use, modification, and redistribution. You can run it in CI, deploy it inside your organisation, and incorporate its outputs into commercial compliance workflows. The licence stays with the OSS project; any custom features we build for you are negotiated separately.

What does a customisation engagement look like?

Typical engagements start with a discovery call to scope the gap between stock VISaR and what your environment needs, common asks are private deployment inside a security boundary, integration with internal ticketing or compliance systems, custom severity thresholds for CI gates, support for private and GitLab/Bitbucket repositories, and bespoke report formats. We then agree a fixed-scope build, deliver, document, and hand over. Most engagements are 2–6 weeks.

Do we own the custom features, or are they upstreamed?

Both are options and we agree this upfront. The default is: anything that benefits the wider community gets upstreamed under Apache 2.0; anything that's organisation-specific (your internal ticketing integration, your compliance schema mappings) stays in your private fork. We never lock you in. You get the source, the runbook, and the ability to maintain it yourselves.

Do you offer support contracts for the stock OSS version?

We offer light-touch support engagements for teams running stock VISaR in production, including monthly check-ins, scan-output reviews, escalation help, and OSS upgrade guidance. If you're integrating VISaR into a regulated audit workflow and want a named engineer behind it, get in touch.

Consulting

Need a private deployment or custom features?

Off-the-shelf scanning doesn't always fit highly regulated environments. We deploy VISaR inside your security boundary and extend it for your stack, compliance regime, and reporting workflows.

Private / in-boundary deploymentPrivate & GitLab/Bitbucket reposCI severity gatesCustom report formatsTicketing & compliance integrations

Discuss a private deployment