osv.dev (Open Source Vulnerabilities) is Google’s open source platform and API for aggregating, managing, and analyzing vulnerability data across multiple ecosystems. It powers the osv.dev
website, providing a unified, queryable database of vulnerabilities that map directly to open source packages and versions. The system hosts vulnerability data for ecosystems such as PyPI, npm, Go, Maven, and Debian, among others. The platform includes a web UI, API, and a Go-based dependency scanner that checks software dependencies, container images, SBOMs (SPDX, CycloneDX), and Git repositories for known vulnerabilities. This repository contains the full infrastructure code for deploying osv.dev on Google Cloud Platform, including Terraform configurations, APIs, data pipelines, indexers, and background workers for vulnerability ingestion and impact analysis. It also integrates with automated feeds from sources like NVD and OSS-Fuzz, enabling continuous updates and high data accuracy.
Features
- Unified vulnerability database with structured, machine-readable data
- Public REST API for querying vulnerabilities by package and version
- Go-based scanner for analyzing dependencies, SBOMs, and containers
- Automated ingestion from NVD, OSS-Fuzz, and other vulnerability feeds
- GCP-based infrastructure with indexers, workers, and cloud functions
- Data dumps and public instance available
Project Samples
