VulnGraph
Sign inGet started

Documentation

How VulnGraph works

VulnGraph builds a unified call graph across your services and repositories and runs inter-service taint analysis on it — so it finds the injection and trust-boundary paths that span service boundaries, the ones single-repo scanners structurally cannot see.

The pipeline

Every scan runs the same four stages:

  1. 1. Map. Parse each repository into a typed graph — HTTP endpoints from your framework code, event APIs from AsyncAPI specs, and service topology from Dockerfiles, docker-compose, Kubernetes manifests and Terraform.
  2. 2. Connect. Link services across repositories by the things they share — message topics, databases, and internal calls — into one architecture graph.
  3. 3. Propagate. Track taint from untrusted sources (endpoints accepting user input) along the graph to sinks — but only across a genuine service boundary, and treating parameterized and ORM-based database writes as safe rather than injectable.
  4. 4. Report. Surface each cross-boundary path with its full route, affected assets, severity and remediation — and export SARIF 2.1.0 for GitHub Code Scanning.

Getting started — three ways to scan

Dashboard. Create an account, connect a GitHub repository, and run a scan from the UI. Findings appear with their attack path, severity and triage controls.

CI — GitHub Action. Add the vulngraph-scan action to your workflow with an API key. It can fail the build on a critical/high threshold, run cross-repo workspace analysis, and upload SARIF to GitHub Code Scanning automatically.

REST API. Drive scans programmatically with a workspace API key — trigger scans, list repositories, fetch results, and download SARIF. See the API reference.

Supported stack

VulnGraph reads endpoints directly from framework code — no OpenAPI file required — and links the architecture from your specs and infrastructure.

Languages & webJavaScript/TypeScript (Express, Fastify, Next.js route handlers), Python (Flask, FastAPI), Go (gin, echo, chi, net/http), Java (Spring MVC), C#/.NET (ASP.NET), Ruby (Rails)
Messaging & eventsKafka (kafkajs, Spring @KafkaListener, NestJS @EventPattern), RabbitMQ / AMQP, AWS SQS, Google Pub/Sub, and AsyncAPI 2.x & 3.0 specifications
Data & sinksSQL writes (raw SQL, Prisma, Knex), OS command execution (child_process, subprocess / os.system, exec.Command), and outbound HTTP to dynamic URLs (fetch, axios, requests, net/http)
InfrastructureDockerfile, docker-compose, Kubernetes manifests, Terraform, plus package.json and requirements.txt for ecosystem detection

What it detects

Cross-service findings include, among others:

  • Cross-service SQL injection (CWE-89) — input reaching a database write in another service
  • Cross-service command injection (CWE-78) — input reaching OS command execution downstream
  • Cross-service SSRF (CWE-918) — input controlling an outbound request to a dynamic URL in another service
  • Implicit-trust / auth-boundary bypass (CWE-306) — an authenticated service handing off to an unauthenticated one
  • Unencrypted sensitive-data flow (CWE-319) — PCI/sensitive data crossing a boundary without encryption
  • Queue-to-database paths where an unauthenticated consumer trusts the bus

Alongside taint, VulnGraph computes blast radius and flags AI-agent access exposure — which agents can reach sensitive data through the graph.

Output & integrations

Every scan exports SARIF 2.1.0, so findings drop straight into GitHub Code Scanning beside your other tools. Cross-repository workspace analysis, scheduled re-scans, and Slack/Discord & email alerts are available on the Team and Enterprise plans.

API reference →Security & trust →Start scanning →