Metadata-Version: 2.4
Name: pinaka-scan
Version: 0.2.0
Summary: Free dependency vulnerability scanner. Like Snyk, but open. Powered by OSV.dev.
Project-URL: Homepage, https://pinaka.sh
Project-URL: Repository, https://github.com/0xparth/pinaka-scan
Project-URL: Issues, https://github.com/0xparth/pinaka-scan/issues
Author-email: Parth Shukla <certsubs@gmail.com>
License-Expression: MIT
License-File: LICENSE
Keywords: cve,dependencies,osv,sca,scanner,security,vulnerability
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.8
Requires-Dist: requests>=2.28
Requires-Dist: rich>=13.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == 'dev'
Description-Content-Type: text/markdown

# pinaka-scan

Free dependency vulnerability scanner. Like Snyk, but open.  
Powered by [OSV.dev](https://osv.dev) — no API key, no signup, no limits.

## Install

```bash
pip install pinaka-scan
```

## Usage

```bash
# Auto-detect manifest in current directory
pinaka-scan

# Scan a specific file
pinaka-scan requirements.txt
pinaka-scan package.json
pinaka-scan go.mod

# Verbose output (show descriptions)
pinaka-scan -v

# JSON output (for CI pipelines)
pinaka-scan --json

# Only fail on critical/high severity
pinaka-scan --fail-on high

# Override ecosystem detection
pinaka-scan lockfile.txt -e PyPI
```

## CI/CD Integration

```yaml
# GitHub Actions
- name: Scan dependencies
  run: |
    pip install pinaka-scan
    pinaka-scan --fail-on high
```

Exit codes:
- `0` — no vulnerabilities (or none above `--fail-on` threshold)
- `1` — vulnerabilities found
- `2` — scan error

## Supported Ecosystems

| Ecosystem | Files |
|-----------|-------|
| Python (PyPI) | `requirements.txt`, `Pipfile.lock` |
| Node.js (npm) | `package.json`, `package-lock.json`, `yarn.lock` |
| Go | `go.mod`, `go.sum` |
| Rust (crates.io) | `Cargo.toml`, `Cargo.lock` |
| Ruby (RubyGems) | `Gemfile.lock` |
| PHP (Packagist) | `composer.json`, `composer.lock` |

## How It Works

1. Reads your dependency manifest
2. Parses package names + versions
3. Batch-queries [OSV.dev](https://osv.dev) (Google's open vulnerability database)
4. Displays results with severity, CVE IDs, and fix versions

No data is stored. No telemetry. Runs entirely on your machine.

## Built by

[Parth Shukla](https://pinaka.sh) — also try [Pinaka](https://pinaka.sh/dependency-scan) for the web version.

## License

MIT
