Application Vulnerability Assessment
Know exactly what's in your code — and what's at risk.
AppVa scans every dependency in your repositories and container images, generates a complete Software Bill of Materials, and maps each component against live CVE databases — so you can fix real risks before they become breaches.
Platform features
Full-spectrum dependency intelligence, from code to container
SBOM Generation
Powered by Syft, AppVa produces a complete Software Bill of Materials for every repository and image — cataloguing all open-source libraries, transitive dependencies, and their exact versions.
CVE Vulnerability Scanning
Grype cross-references every component in your SBOM against live CVE databases, surfacing exploitable vulnerabilities with CVSS scores and affected version ranges so you know exactly what to patch.
Multi-Source Repository Support
Connect GitHub repositories via HTTPS with optional branch selection and access tokens, upload ZIP archives of source code, or scan Docker images and .tar archives — all from a single interface.
Dashboard & Analytics
Aggregate statistics across all repositories: vulnerability severity distribution charts, top vulnerable packages, license distribution analysis, and trend views to track your security posture over time.
Scheduled Scanning
Define cron-based scan schedules per repository with 30-second check intervals. Pause and resume schedules without deletion — maintain continuous coverage without manual intervention.
Notification Channels
Receive automated scan summaries via Slack, Microsoft Teams, or any webhook endpoint. Multiple channels per repository, with add, edit, test, and enable/disable controls for each integration.
PDF Reporting
Export full scan results as PDF reports including CVE IDs, affected packages, CVSS scores, and SBOM component lists — ready for audits, compliance reviews, or executive briefings.
Role-Based Access & 2FA
TOTP two-factor authentication at login and admin-controlled reset capability. Three permission levels — viewer, operator, and admin — ensure the right people have the right access to scan data and configuration.
Ready to see every dependency risk across your codebase?
Request access Frequently asked questions
Search keywords..
What types of repositories and sources can AppVa scan?
How does the SBOM and vulnerability scanning pipeline work?
Is there a cost to use AppVa?
Can AppVa notify our team automatically when a scan finds new vulnerabilities?
Didn’t find the answer you were looking for?
Contact us, we’re here to help