FOSSA aggregates CVE data from NVD, GitHub Security Advisories, and its own review.

How FOSSA scans imported SBOMs for known vulnerabilities.

Triage security vulnerabilities across all your projects from a single Issues inbox.

Define which vulnerability severities trigger issues and gate builds.

Scan container images for vulnerabilities in base layers and dependencies.

Get a prioritized upgrade plan that fixes the most vulnerabilities with fewest changes.

Identify open source and vulnerabilities in compiled binaries and archives.

Security

Step-by-step onboarding paths for developers, security teams, and legal & compliance.

Install the CLI, analyze your first project, and wire FOSSA into CI so every pull request is checked automatically — no manual scans.

For Developers

Detect CVEs across your dependencies, set severity policies that gate builds, and focus on vulnerabilities that are actually reachable in your code.

For Security Teams

Surface license obligations per dependency, enforce policies that flag or block disallowed licenses, and produce audit-ready attribution reports automatically.

For Legal & Compliance

User Guides

Explore FOSSA products — compliance, security, quality, SBOM, and more.

License obligations, attribution, and policy enforcement for the open source in your code.

Compliance

Find, prioritize, and fix vulnerabilities across your dependencies.

Code quality signals and dependency health monitoring.

Quality

Generate, aggregate, import, and share software bills of materials across the full SBOM lifecycle.

SBOM Management

The FOSSA AI agent for dependency upgrades, SAST security review, and AI code guardrails.

fossabot

Product Guides

Build integrations and automate workflows with the FOSSA REST API.

authentication

cpe-lookup

errors

introduction

webhook-notifications

creating-jira-tickets

downloading-attribution-reports

generating-reports

initiating-a-binary-scan

managing-issues

managing-users-and-teams

modifying-release-groups

retrieving-latest-revision

rotating-access-tokens

index

Endpoint Reference

API Reference

Analyze dependencies, test policies, and generate reports from the command line.

differences-from-v1

telemetry

analysis-and-analyzers

custom-license-and-keyword-search-regular-expression-syntax

custom-license-and-keyword-searches

first-party-license-scans

manual-dependencies

snippet-scanning

strategy-command-selection

vendetta

vendored-dependencies

path-dependency

fossa-deps

fossa-yml

analyze

container

init

list-targets

project

release-group

report

sbom

test

analysis-target-configuration

aosp

buildroot

conan

container-scanning-generic-ci

custom-integrating-with-bower-example

installing-fossa-cli

integrating

proxy-configuration

ssl-cert

what-data-gets-uploaded

yocto

FOSSA CLI

Automated PR comments and status checks that surface license, security, and quality findings in pull requests.

ai-guardrails

continuous-integration

dependency-upgrades

intended-uses

sast-security-review

setup

supported-ecosystems

system-architecture

New to FOSSA? Import your first project, run a scan, and see results in minutes.

cli-vs-quick-import

your-first-scan

Get Started

Troubleshooting, FAQs, and how to get support from FOSSA.

cli-debug-bundle

dependencylocks-deprecation

incomplete-dependencies

license-conclusions-vs-corrections

why-cicd-integration

Help & Support

Connect FOSSA to CI/CD, source hosts, Jira, Slack, and fossabot.

aws-codebuild

azure-repos

bitbucket-cloud

bitbucket-server

circleci

concourse-ci

creating-a-jira-ticket

fail-cicd-checks

generic-ci

github-actions

github-app

github

gitlab

jenkins

jfrog-artifactory

jira

nexus

openid-connect

slack

teamcity

travisci

Integrations

Track, triage, and manage licensing, security, and quality issues across your projects.

comparing-issues

global-summary

ignoring-issues

issue-details

time-based-ignore-rules

Issues

Terms of service, privacy policy, and other legal documentation.

acceptable-use-policy

dmca-notice

enterprise-terms-of-service

privacy-policy

responsible-disclosure-policy

security

terms-of-service

Legal

Detect open source licenses, understand obligations, generate attribution, and track your compliance posture.

custom-license-scans

license-conclusions

license-corrections

license-disputes

reviewing-licensing-issues

understanding-licensing-issues

Licenses

Deploy and operate FOSSA in your own infrastructure with Kubernetes and Helm.

architecture-overview

ip-space-allowlisting

helm-values-reference

installation-requirements

post-install-configuration

bitnami-image-pull-errors

debug-bundle

decoupling-minio

dependency-metadata-migration

global-license-corrections

helm-chart-500-breaking-change

helm-chart-600-breaking-change

helm-chart-700-breaking-change

helm-chart-800-breaking-change

migrating-to-postgres-17

migrating-to-seaweedfs

updating-helm-values

upgrading-fossa

vulnerability-database-updates

On-Premises Deployment

Manage users, teams, roles, SSO, and organization-wide settings for your FOSSA instance.

api-tokens

audit-logs

counting-contributors

default-project-settings

inviting-users

organization-settings

package-labels

role-based-access-control

active-directory-federation-service

auth0

g-suite

ldap

microsoft-entra-id

okta

saml-attributes

Organization Management

Define rules once and enforce them automatically across licenses, vulnerabilities, and quality.

licensing-policies

quality-policy

sbom-policy

security-policy

Policies

Get your code into FOSSA — import projects from source hosts, the CLI, or CI, then configure how they're scanned and organized.