anthropics/oss-scanner

选用指南

AI 根据 README 整理 · 2026/10/14 15:21:01

适用场景

适用于希望获得开源项目安全漏洞扫描和修复建议的维护者。

查看 README 依据

# OSS Scanner OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities. Learn more about the service at [red.anthropic.com/oss-scanner](https://red.anthropic.com/oss-scanner). Note, use of this tool is subject to the terms and conditions outlined in the [OSS Scanner terms](https://red.anthropic.com/oss-scanner/terms). ## How to sign up Enroll an open-source project by opening a pull request that adds one directory: ``` projects/<name> ```

Our security scanner builds your project in an isolated VM, then analyses it with no Internet access and emails what it finds to `primary_contact` (and any CCs), each with a reproducer and a proposed patch where available. Reports are model-generated and are not reviewed by a human. Because of this we do not place a 90-day disclosure period on these findings and will not make them public. Project owners should provide `project.yaml` (to configure the scanner), a `Dockerfile` (stating how to build the project), and optionally a `threat_model.md` (providing project-specific threat modeling).

目标用户

面向开源项目的维护者，需要注册项目并配置扫描参数。

查看 README 依据

# OSS Scanner OSS Scanner is a service by Anthropic to scan critical open-source repositories for security vulnerabilities. Learn more about the service at [red.anthropic.com/oss-scanner](https://red.anthropic.com/oss-scanner). Note, use of this tool is subject to the terms and conditions outlined in the [OSS Scanner terms](https://red.anthropic.com/oss-scanner/terms). ## How to sign up Enroll an open-source project by opening a pull request that adds one directory: ``` projects/<name> ```

### project.yaml Start from `templates/project.yaml`: ``` repo: https://github.com/example/project # required: the git repository to scan; add #branch to pin one primary_contact: security@example.org # required: reports and build problems go here (one address) auto_ccs: # optional: more addresses on every mail - maintainer@example.org homepage: https://example.org # optional disabled: false # optional: true pauses reports without removing the enrolment

使用方式

通过提交拉取请求添加项目目录进行注册，使用 tools/validate.py 和 tools/check 进行本地验证。

查看 README 依据

anything else you think important or useful. We suggest you run two commands before opening a pull request: * `tools/validate.py` checks `projects/<name>/` against the rules above. * `tools/check <name>` builds your project the way our scanner will, and opens a shell in the finished image with no network. If your tests pass in this container, our scanner will likely work with your project. `tools/check --qemu <name>` does the same inside virtual machines laid out like the scanner's.

部署要求

本地验证工具需要安装 git、Docker 和 Python 3 及 PyYAML；--qemu 模式需要 Linux x86-64 和 QEMU。

查看 README 依据

These tools need your host to have installed git, Docker, and Python 3 with PyYAML (`pip install pyyaml`); `--qemu` needs Linux on x86-64 with QEMU instead of Docker. ## What happens after the merge 1. The scanner imports the project, builds it online in an isolated VM, then moves the VM to a network with no Internet access for scanning. If the build fails, we will email `primary_contact` with an error message. 2. We scan the project for vulnerabilities. 3. Findings are emailed to `primary_contact` and any additional CCs with reproduction steps and a proposed patch where available.

已知限制

报告由模型生成且未经人工审查，不设 90 天披露期，不会公开漏洞信息。

查看 README 依据

Our security scanner builds your project in an isolated VM, then analyses it with no Internet access and emails what it finds to `primary_contact` (and any CCs), each with a reproducer and a proposed patch where available. Reports are model-generated and are not reviewed by a human. Because of this we do not place a 90-day disclosure period on these findings and will not make them public. Project owners should provide `project.yaml` (to configure the scanner), a `Dockerfile` (stating how to build the project), and optionally a `threat_model.md` (providing project-specific threat modeling).