[{"data":1,"prerenderedAt":2764},["ShallowReactive",2],{"docs-navigation":3,"-docs-guides-security-relic-scan":410,"-docs-guides-security-relic-scan-surround":2759},[4,19,166,319,333,397],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":18},"Overview","i-lucide-compass","\u002Fdocs\u002Foverview","docs\u002F1.overview",[10,14],{"title":11,"path":12,"stem":13},"Introduction","\u002Fdocs\u002Foverview\u002Fintroduction","docs\u002F1.overview\u002F1.introduction",{"title":15,"path":16,"stem":17},"JFrog compatibility","\u002Fdocs\u002Foverview\u002Fjfrog-compatibility","docs\u002F1.overview\u002F2.jfrog-compatibility",false,{"title":20,"icon":21,"path":22,"stem":23,"children":24,"page":18},"Installation","i-lucide-download","\u002Fdocs\u002Finstallation","docs\u002F2.installation",[25,29,43,68,108,112,116,162],{"title":26,"path":27,"stem":28},"Choosing a method","\u002Fdocs\u002Finstallation\u002Foverview","docs\u002F2.installation\u002F1.overview",{"title":30,"icon":31,"path":32,"stem":33,"children":34,"page":18},"Single binary","i-lucide-terminal","\u002Fdocs\u002Finstallation\u002Fsingle-binary","docs\u002F2.installation\u002F2.single-binary",[35,39],{"title":36,"path":37,"stem":38},"Quick start","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Fquick-start","docs\u002F2.installation\u002F2.single-binary\u002F1.quick-start",{"title":40,"path":41,"stem":42},"Limits and backups","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Foperations","docs\u002F2.installation\u002F2.single-binary\u002F2.operations",{"title":44,"icon":45,"path":46,"stem":47,"children":48,"page":18},"Docker","i-simple-icons-docker","\u002Fdocs\u002Finstallation\u002Fdocker","docs\u002F2.installation\u002F3.docker",[49,52,56,60,64],{"title":36,"path":50,"stem":51},"\u002Fdocs\u002Finstallation\u002Fdocker\u002Fquick-start","docs\u002F2.installation\u002F3.docker\u002F1.quick-start",{"title":53,"path":54,"stem":55},"PostgreSQL and S3","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fpostgresql-and-s3","docs\u002F2.installation\u002F3.docker\u002F2.postgresql-and-s3",{"title":57,"path":58,"stem":59},"Docker Compose","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose","docs\u002F2.installation\u002F3.docker\u002F3.compose",{"title":61,"path":62,"stem":63},"Compose settings","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-settings","docs\u002F2.installation\u002F3.docker\u002F4.compose-settings",{"title":65,"path":66,"stem":67},"Compose with another object store","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-other-object-storage","docs\u002F2.installation\u002F3.docker\u002F5.compose-other-object-storage",{"title":69,"icon":70,"path":71,"stem":72,"children":73,"page":18},"Kubernetes","i-simple-icons-kubernetes","\u002Fdocs\u002Finstallation\u002Fkubernetes","docs\u002F2.installation\u002F4.kubernetes",[74,77,80,84,88,92,96,100,104],{"title":5,"path":75,"stem":76},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Foverview","docs\u002F2.installation\u002F4.kubernetes\u002F1.overview",{"title":36,"path":78,"stem":79},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fquick-start","docs\u002F2.installation\u002F4.kubernetes\u002F2.quick-start",{"title":81,"path":82,"stem":83},"External PostgreSQL","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-postgresql","docs\u002F2.installation\u002F4.kubernetes\u002F3.external-postgresql",{"title":85,"path":86,"stem":87},"External object storage","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-object-storage","docs\u002F2.installation\u002F4.kubernetes\u002F4.external-object-storage",{"title":89,"path":90,"stem":91},"Exposing Relic","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexposing","docs\u002F2.installation\u002F4.kubernetes\u002F5.exposing",{"title":93,"path":94,"stem":95},"Values","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fvalues","docs\u002F2.installation\u002F4.kubernetes\u002F6.values",{"title":97,"path":98,"stem":99},"Upgrades and removal","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fupgrades","docs\u002F2.installation\u002F4.kubernetes\u002F7.upgrades",{"title":101,"path":102,"stem":103},"Hardening and probes","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fhardening","docs\u002F2.installation\u002F4.kubernetes\u002F8.hardening",{"title":105,"path":106,"stem":107},"Monitoring","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fmonitoring","docs\u002F2.installation\u002F4.kubernetes\u002F9.monitoring",{"title":109,"path":110,"stem":111},"Cloudflare","\u002Fdocs\u002Finstallation\u002Fcloudflare","docs\u002F2.installation\u002F5.cloudflare",{"title":113,"path":114,"stem":115},"Configuration reference","\u002Fdocs\u002Finstallation\u002Fconfiguration","docs\u002F2.installation\u002F6.configuration",{"title":117,"icon":118,"path":119,"stem":120,"children":121,"page":18},"Storage","i-lucide-hard-drive","\u002Fdocs\u002Finstallation\u002Fstorage","docs\u002F2.installation\u002F7.storage",[122,126,130,134,138,142,146,150,154,158],{"title":123,"path":124,"stem":125},"Storage overview","\u002Fdocs\u002Finstallation\u002Fstorage\u002Foverview","docs\u002F2.installation\u002F7.storage\u002F1.overview",{"title":127,"path":128,"stem":129},"Azure Blob Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fazure-blob-storage","docs\u002F2.installation\u002F7.storage\u002F10.azure-blob-storage",{"title":131,"path":132,"stem":133},"SeaweedFS","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fseaweedfs","docs\u002F2.installation\u002F7.storage\u002F2.seaweedfs",{"title":135,"path":136,"stem":137},"Amazon S3","\u002Fdocs\u002Finstallation\u002Fstorage\u002Famazon-s3","docs\u002F2.installation\u002F7.storage\u002F3.amazon-s3",{"title":139,"path":140,"stem":141},"Cloudflare R2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fcloudflare-r2","docs\u002F2.installation\u002F7.storage\u002F4.cloudflare-r2",{"title":143,"path":144,"stem":145},"MinIO","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fminio","docs\u002F2.installation\u002F7.storage\u002F5.minio",{"title":147,"path":148,"stem":149},"Google Cloud Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fgoogle-cloud-storage","docs\u002F2.installation\u002F7.storage\u002F6.google-cloud-storage",{"title":151,"path":152,"stem":153},"Backblaze B2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fbackblaze-b2","docs\u002F2.installation\u002F7.storage\u002F7.backblaze-b2",{"title":155,"path":156,"stem":157},"Other S3-compatible services","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fother","docs\u002F2.installation\u002F7.storage\u002F8.other",{"title":159,"path":160,"stem":161},"Filesystem","\u002Fdocs\u002Finstallation\u002Fstorage\u002Ffilesystem","docs\u002F2.installation\u002F7.storage\u002F9.filesystem",{"title":163,"path":164,"stem":165},"Development","\u002Fdocs\u002Finstallation\u002Fdevelopment","docs\u002F2.installation\u002F8.development",{"title":167,"icon":168,"path":169,"stem":170,"children":171,"page":18},"Guides","i-lucide-book-open","\u002Fdocs\u002Fguides","docs\u002F3.guides",[172,176,180,254,296,300,303,307,311,315],{"title":173,"path":174,"stem":175},"Repositories","\u002Fdocs\u002Fguides\u002Frepositories","docs\u002F3.guides\u002F1.repositories",{"title":177,"path":178,"stem":179},"Replication","\u002Fdocs\u002Fguides\u002Freplication","docs\u002F3.guides\u002F10.replication",{"title":181,"icon":182,"path":183,"stem":184,"children":185,"page":18},"Package types","i-lucide-package","\u002Fdocs\u002Fguides\u002Fpackage-types","docs\u002F3.guides\u002F2.package-types",[186,190,194,198,202,206,210,214,218,222,226,230,234,238,242,246,250],{"title":187,"path":188,"stem":189},"npm, yarn and pnpm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnpm","docs\u002F3.guides\u002F2.package-types\u002F01.npm",{"title":191,"path":192,"stem":193},"Maven and Gradle","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fmaven-gradle","docs\u002F3.guides\u002F2.package-types\u002F02.maven-gradle",{"title":195,"path":196,"stem":197},"Docker and OCI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdocker","docs\u002F3.guides\u002F2.package-types\u002F03.docker",{"title":199,"path":200,"stem":201},"Go","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgo","docs\u002F3.guides\u002F2.package-types\u002F04.go",{"title":203,"path":204,"stem":205},"PyPI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fpypi","docs\u002F3.guides\u002F2.package-types\u002F05.pypi",{"title":207,"path":208,"stem":209},"Helm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhelm","docs\u002F3.guides\u002F2.package-types\u002F06.helm",{"title":211,"path":212,"stem":213},"NuGet","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnuget","docs\u002F3.guides\u002F2.package-types\u002F07.nuget",{"title":215,"path":216,"stem":217},"RubyGems","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frubygems","docs\u002F3.guides\u002F2.package-types\u002F08.rubygems",{"title":219,"path":220,"stem":221},"Cargo","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fcargo","docs\u002F3.guides\u002F2.package-types\u002F09.cargo",{"title":223,"path":224,"stem":225},"Conan","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fconan","docs\u002F3.guides\u002F2.package-types\u002F10.conan",{"title":227,"path":228,"stem":229},"Terraform and OpenTofu","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fterraform","docs\u002F3.guides\u002F2.package-types\u002F11.terraform",{"title":231,"path":232,"stem":233},"Hugging Face","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhugging-face","docs\u002F3.guides\u002F2.package-types\u002F12.hugging-face",{"title":235,"path":236,"stem":237},"Generic files","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgeneric","docs\u002F3.guides\u002F2.package-types\u002F13.generic",{"title":239,"path":240,"stem":241},"RPM","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frpm","docs\u002F3.guides\u002F2.package-types\u002F14.rpm",{"title":243,"path":244,"stem":245},"Debian","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdebian","docs\u002F3.guides\u002F2.package-types\u002F15.debian",{"title":247,"path":248,"stem":249},"Alpine","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Falpine","docs\u002F3.guides\u002F2.package-types\u002F16.alpine",{"title":251,"path":252,"stem":253},"Nix","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnix","docs\u002F3.guides\u002F2.package-types\u002F17.nix",{"title":255,"icon":256,"path":257,"stem":258,"children":259,"page":18},"Security","i-lucide-shield","\u002Fdocs\u002Fguides\u002Fsecurity","docs\u002F3.guides\u002F3.security",[260,264,268,272,276,280,284,288,292],{"title":261,"path":262,"stem":263},"Permissions","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fpermissions","docs\u002F3.guides\u002F3.security\u002F1.permissions",{"title":265,"path":266,"stem":267},"LDAP","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fldap","docs\u002F3.guides\u002F3.security\u002F2.ldap",{"title":269,"path":270,"stem":271},"Access tokens","\u002Fdocs\u002Fguides\u002Fsecurity\u002Ftokens","docs\u002F3.guides\u002F3.security\u002F3.tokens",{"title":273,"path":274,"stem":275},"Relic Scan","\u002Fdocs\u002Fguides\u002Fsecurity\u002Frelic-scan","docs\u002F3.guides\u002F3.security\u002F4.relic-scan",{"title":277,"path":278,"stem":279},"CVE intelligence","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fcve-intelligence","docs\u002F3.guides\u002F3.security\u002F5.cve-intelligence",{"title":281,"path":282,"stem":283},"Audit log","\u002Fdocs\u002Fguides\u002Fsecurity\u002Faudit-log","docs\u002F3.guides\u002F3.security\u002F6.audit-log",{"title":285,"path":286,"stem":287},"Single sign-on","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fsingle-sign-on","docs\u002F3.guides\u002F3.security\u002F7.single-sign-on",{"title":289,"path":290,"stem":291},"SCIM provisioning","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fscim","docs\u002F3.guides\u002F3.security\u002F8.scim",{"title":293,"path":294,"stem":295},"Workload identities","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fworkload-identities","docs\u002F3.guides\u002F3.security\u002F9.workload-identities",{"title":297,"path":298,"stem":299},"Operations","\u002Fdocs\u002Fguides\u002Foperations","docs\u002F3.guides\u002F4.operations",{"title":105,"path":301,"stem":302},"\u002Fdocs\u002Fguides\u002Fmonitoring","docs\u002F3.guides\u002F5.monitoring",{"title":304,"path":305,"stem":306},"Metrics reference","\u002Fdocs\u002Fguides\u002Fmetrics-reference","docs\u002F3.guides\u002F6.metrics-reference",{"title":308,"path":309,"stem":310},"Webhooks","\u002Fdocs\u002Fguides\u002Fwebhooks","docs\u002F3.guides\u002F7.webhooks",{"title":312,"path":313,"stem":314},"Projects","\u002Fdocs\u002Fguides\u002Fprojects","docs\u002F3.guides\u002F8.projects",{"title":316,"path":317,"stem":318},"AI agents","\u002Fdocs\u002Fguides\u002Fai-agents","docs\u002F3.guides\u002F9.ai-agents",{"title":320,"icon":321,"path":322,"stem":323,"children":324,"page":18},"API","i-lucide-braces","\u002Fdocs\u002Fapi","docs\u002F4.api",[325,329],{"title":326,"path":327,"stem":328},"API usage","\u002Fdocs\u002Fapi\u002Foverview","docs\u002F4.api\u002F1.overview",{"title":330,"path":331,"stem":332},"Relic API","\u002Fdocs\u002Fapi\u002Frelic-api","docs\u002F4.api\u002F2.relic-api",{"title":334,"icon":31,"path":335,"stem":336,"children":337,"page":18},"CLI","\u002Fdocs\u002Fcli","docs\u002F5.cli",[338,341,345,349,353,357,361,365,369,373,377,381,385,389,393],{"title":5,"path":339,"stem":340},"\u002Fdocs\u002Fcli\u002Foverview","docs\u002F5.cli\u002F01.overview",{"title":342,"path":343,"stem":344},"Sign in and contexts","\u002Fdocs\u002Fcli\u002Fsign-in","docs\u002F5.cli\u002F02.sign-in",{"title":346,"path":347,"stem":348},"Resources","\u002Fdocs\u002Fcli\u002Fresources","docs\u002F5.cli\u002F03.resources",{"title":350,"path":351,"stem":352},"apply, diff and delete","\u002Fdocs\u002Fcli\u002Fapply","docs\u002F5.cli\u002F04.apply",{"title":354,"path":355,"stem":356},"Artifacts","\u002Fdocs\u002Fcli\u002Ffiles","docs\u002F5.cli\u002F05.files",{"title":358,"path":359,"stem":360},"Server, API and tokens","\u002Fdocs\u002Fcli\u002Fplatform","docs\u002F5.cli\u002F06.platform",{"title":362,"path":363,"stem":364},"Builds and images","\u002Fdocs\u002Fcli\u002Fbuilds","docs\u002F5.cli\u002F07.builds",{"title":366,"path":367,"stem":368},"Scanning and auditing","\u002Fdocs\u002Fcli\u002Fsecurity","docs\u002F5.cli\u002F08.security",{"title":370,"path":371,"stem":372},"Releases","\u002Fdocs\u002Fcli\u002Freleases","docs\u002F5.cli\u002F09.releases",{"title":374,"path":375,"stem":376},"Evidence","\u002Fdocs\u002Fcli\u002Fevidence","docs\u002F5.cli\u002F10.evidence",{"title":378,"path":379,"stem":380},"Package managers","\u002Fdocs\u002Fcli\u002Fpackage-managers","docs\u002F5.cli\u002F11.package-managers",{"title":382,"path":383,"stem":384},"Scan reports and VEX","\u002Fdocs\u002Fcli\u002Freports-and-vex","docs\u002F5.cli\u002F12.reports-and-vex",{"title":386,"path":387,"stem":388},"Migrating from Artifactory","\u002Fdocs\u002Fcli\u002Fimport","docs\u002F5.cli\u002F13.import",{"title":390,"path":391,"stem":392},"Database","\u002Fdocs\u002Fcli\u002Fdatabase","docs\u002F5.cli\u002F14.database",{"title":394,"path":395,"stem":396},"Machine setup","\u002Fdocs\u002Fcli\u002Fsetup","docs\u002F5.cli\u002F15.setup",{"title":398,"icon":399,"path":400,"stem":401,"children":402,"page":18},"SDK","i-lucide-boxes","\u002Fdocs\u002Fsdk","docs\u002F6.sdk",[403,406],{"title":5,"path":404,"stem":405},"\u002Fdocs\u002Fsdk\u002Foverview","docs\u002F6.sdk\u002F1.overview",{"title":407,"path":408,"stem":409},"Relic API clients","\u002Fdocs\u002Fsdk\u002Frelic-api-clients","docs\u002F6.sdk\u002F2.relic-api-clients",{"id":411,"title":273,"body":412,"description":2752,"extension":2753,"links":2754,"meta":2755,"navigation":2756,"path":274,"seo":2757,"stem":275,"__hash__":2758},"docs\u002Fdocs\u002F3.guides\u002F3.security\u002F4.relic-scan.md",{"type":413,"value":414,"toc":2726},"minimark",[415,458,463,466,623,688,707,711,736,740,757,771,775,784,804,815,822,826,829,915,921,958,961,999,1003,1016,1022,1025,1042,1045,1077,1080,1084,1093,1194,1197,1305,1308,1312,1340,1410,1417,1421,1469,1501,1506,1513,1595,1598,1631,1653,1657,1674,1678,1687,1690,1722,1729,1732,1753,1762,1766,1780,1849,1868,1872,1875,1878,1955,1975,1979,1986,2009,2015,2018,2036,2039,2092,2095,2114,2117,2133,2141,2158,2168,2178,2195,2197,2216,2219,2234,2238,2255,2259,2262,2323,2341,2345,2352,2467,2470,2493,2496,2512,2516,2522,2525,2544,2548,2556,2560,2567,2570,2608,2611,2633,2636,2663,2666,2701,2704,2722],[416,417,418,419,423,424,427,428,432,433,436,437,441,442,432,445,448,449,452,453,457],"p",{},"The worker catalogs every scannable file with Syft, such as package archives and Docker image\nmanifests, and matches the catalog against Grype's vulnerability database. Without either\nbinary, Relic Scan is off. The server counts it as on while a worker with both binaries\nreported its scan queue in the last 20 minutes. When it is off, a file waiting for a scan\nshows ",[420,421,422],"em",{},"unavailable"," instead of ",[420,425,426],{},"queued",", and ",[429,430,431],"strong",{},"Home",", ",[429,434,435],{},"Administration → System"," and\n",[438,439,440],"code",{},"relic security database status"," say that Relic Scan is off. The settings are ",[438,443,444],{},"RELIC_SCAN_SYFT_PATH",[438,446,447],{},"RELIC_SCAN_GRYPE_PATH","\nand ",[438,450,451],{},"RELIC_SCAN_VULNERABILITY_DATABASE_DIR","; see the\n",[454,455,456],"a",{"href":114},"configuration reference",".",[459,460,462],"h2",{"id":461},"what-relic-scan-scans","What Relic Scan scans",[416,464,465],{},"The worker scans these files, by name:",[467,468,469,517,529,564],"ul",{},[470,471,472,473,432,476,432,479,432,482,432,485,432,488,432,491,432,494,497,498,432,501,432,504,432,507,432,510,513,514,457],"li",{},"Package archives: ",[438,474,475],{},".jar",[438,477,478],{},".war",[438,480,481],{},".ear",[438,483,484],{},".tgz",[438,486,487],{},".tar.gz",[438,489,490],{},".tar.bz2",[438,492,493],{},".tar.xz",[438,495,496],{},".txz",",\n",[438,499,500],{},".whl",[438,502,503],{},".egg",[438,505,506],{},".zip",[438,508,509],{},".nupkg",[438,511,512],{},".crate"," and ",[438,515,516],{},".gem",[470,518,519,520,432,523,513,526,457],{},"OS packages: ",[438,521,522],{},".deb",[438,524,525],{},".rpm",[438,527,528],{},".apk",[470,530,531,532,535,536,432,539,432,542,497,545,432,548,432,551,432,554,432,557,432,560,563],{},"Docker image manifests (",[438,533,534],{},"manifest.json",") and model files (",[438,537,538],{},".pkl",[438,540,541],{},".pickle",[438,543,544],{},".joblib",[438,546,547],{},".dill",[438,549,550],{},".pt",[438,552,553],{},".pth",[438,555,556],{},".bin",[438,558,559],{},".ckpt",[438,561,562],{},".npy",").",[470,565,566,567,432,570,432,573,432,576,432,579,432,582,432,585,497,588,591,592,432,595,432,598,497,601,432,604,432,607,432,610,432,613,497,616,432,619,622],{},"Configuration files (",[438,568,569],{},".yaml",[438,571,572],{},".yml",[438,574,575],{},".tf",[438,577,578],{},".tfvars",[438,580,581],{},".env",[438,583,584],{},".dockerfile",[438,586,587],{},"Dockerfile",[438,589,590],{},"Containerfile",") and lock files (",[438,593,594],{},"package-lock.json",[438,596,597],{},"npm-shrinkwrap.json",[438,599,600],{},"yarn.lock",[438,602,603],{},"Gemfile.lock",[438,605,606],{},"Cargo.lock",[438,608,609],{},"composer.lock",[438,611,612],{},"poetry.lock",[438,614,615],{},"Pipfile.lock",[438,617,618],{},"requirements*.txt",[438,620,621],{},"go.mod","), for secrets, misconfigurations and the packages they name.",[416,624,625,626,432,629,432,632,432,635,432,638,641,642,645,646,432,649,432,652,513,655,658,659,432,662,497,665,513,668,671,672,675,676,679,680,683,684,687],{},"Grype matches an OS package only against its distribution's data. Relic takes the release from\nthe package version (",[438,627,628],{},"el8",[438,630,631],{},"fc39",[438,633,634],{},"amzn2",[438,636,637],{},"+deb11u2",[438,639,640],{},"ubuntu0.22.04","). For a Debian package\nwhose version names none, Relic takes it from the ",[438,643,644],{},"deb.distribution"," the package is published\nunder: ",[438,647,648],{},"buster",[438,650,651],{},"bullseye",[438,653,654],{},"bookworm",[438,656,657],{},"trixie"," (Debian 10 to 13), ",[438,660,661],{},"bionic",[438,663,664],{},"focal",[438,666,667],{},"jammy",[438,669,670],{},"noble"," (Ubuntu 18.04 to 24.04), with a suite suffix such as ",[438,673,674],{},"-security"," ignored\nand the oldest release taken when there are several. An Alpine package takes it from a ",[438,677,678],{},"vX.Y","\nfolder in its path. When none names one, as for ",[438,681,682],{},"sid",", the scan is ",[420,685,686],{},"partial"," and its reason\nsays that the package's OS vulnerabilities were not matched.",[416,689,690,691,694,695,698,699,702,703,706],{},"Quarantine and ",[420,692,693],{},"Also block artifacts without a successful scan"," hold only package archives,\nOS packages, image manifests and model files. Other files, configuration files included, are\nserved before they are scanned. For such a file, ",[438,696,697],{},"GET \u002Fapi\u002Fv1\u002Frepositories\u002F\u003Crepo>\u002Fdownload-checks\u002F\u003Cpath>"," answers rule ",[438,700,701],{},"not_held",", and\n",[438,704,705],{},"relic_downloads_not_held_total"," counts these downloads.",[459,708,710],{"id":709},"in-the-ui","In the UI",[467,712,713,719,730],{},[470,714,715,716,718],{},"An artifact's ",[429,717,255],{}," tab shows its findings (for a Docker tag, the image's), with\nCVSS scores and where each vulnerable package was found.",[470,720,721,722,725,726,729],{},"The ",[429,723,724],{},"SBOM"," tab lists every component with its licenses. Filter by license or to license\npolicy violations; a filter for one license matches ",[438,727,728],{},"MIT OR Apache-2.0",". Hover over a\nviolation to see its policy, rule and watch.",[470,731,732,735],{},[429,733,734],{},"Security → Vulnerabilities"," lists every finding, filtered by severity, repository, package\ntype, fixable, known exploited or malicious.",[459,737,739],{"id":738},"malicious-packages","Malicious packages",[416,741,742,743,749,750,753,754,457],{},"Every scan also reports the packages named in\n",[454,744,748],{"href":745,"rel":746},"https:\u002F\u002Fgithub.com\u002Fossf\u002Fmalicious-packages",[747],"nofollow","OpenSSF's malicious-packages data"," (",[438,751,752],{},"MAL-","\nadvisories). The worker reads them from OSV every six hours, for npm, PyPI, Maven, Go, NuGet,\ncrates.io and RubyGems, and checks earlier scans again when a new advisory arrives. A\nmalicious package is a critical finding marked ",[420,755,756],{},"Malicious",[416,758,759,760,749,763,766,767,770],{},"A policy rule set to ",[420,761,762],{},"Matches: Malicious packages",[438,764,765],{},"malicious: true",") matches only these.\nWith ",[420,768,769],{},"Block downloads",", a remote repository stops serving a package as soon as it is reported.",[459,772,774],{"id":773},"reachability-go","Reachability (Go)",[416,776,777,778,783],{},"The worker runs ",[454,779,782],{"href":780,"rel":781},"https:\u002F\u002Fgo.dev\u002Fblog\u002Fgovulncheck",[747],"govulncheck"," on every Go executable a scan\nfinds, alone, in an archive or in an image. A Go finding is then:",[467,785,786,792,798],{},[470,787,788,791],{},[429,789,790],{},"Reachable",": the executable calls a vulnerable function. The finding shows the call.",[470,793,794,797],{},[429,795,796],{},"Not reachable",": the executable contains the module, but no code calls the vulnerable\nfunctions.",[470,799,800,803],{},[429,801,802],{},"Unknown",": every other finding, including other languages, Go module sources and\nbinaries without build information.",[416,805,806,807,810,811,814],{},"A security rule can skip unreachable findings: ",[420,808,809],{},"Skip Go vulnerabilities no code calls","\n(",[438,812,813],{},"ignoreUnreachable: true","). Unknown findings still count.",[416,816,817,818,821],{},"govulncheck reads the Go vulnerability database, which the worker downloads with Grype's from\n",[438,819,820],{},"RELIC_SCAN_GO_VULNERABILITY_DATABASE_URL",". When it changes, the worker checks the stored\nsymbol summaries of scanned executables again, without downloading the artifacts.",[459,823,825],{"id":824},"operational-risk","Operational risk",[416,827,828],{},"Every scan also reports operational risks, apart from vulnerabilities:",[830,831,832,848],"table",{},[833,834,835],"thead",{},[836,837,838,842,845],"tr",{},[839,840,841],"th",{},"Risk",[839,843,844],{},"Severity",[839,846,847],{},"Source",[849,850,851,871,884],"tbody",{},[836,852,853,860,863],{},[854,855,856,859],"td",{},[429,857,858],{},"End of life",": the component, or an image's operating system, is past its release cycle's end of life",[854,861,862],{},"high",[854,864,865,870],{},[454,866,869],{"href":867,"rel":868},"https:\u002F\u002Fendoflife.date",[747],"endoflife.date",", read daily",[836,872,873,878,881],{},[854,874,875,877],{},[429,876,858],{}," within 90 days",[854,879,880],{},"low",[854,882,883],{},"the same",[836,885,886,900,903],{},[854,887,888,891,892,895,896,899],{},[429,889,890],{},"Deprecated"," by its maintainers, or ",[429,893,894],{},"unmaintained"," (no source activity for 90 days, OpenSSF Scorecard ",[420,897,898],{},"Maintained",")",[854,901,902],{},"medium",[854,904,905,910,911,914],{},[454,906,909],{"href":907,"rel":908},"https:\u002F\u002Fdeps.dev",[747],"deps.dev",", only when ",[438,912,913],{},"RELIC_DEPS_DEV_URL"," is set, since each check sends it a package name and version",[416,916,917,920],{},[429,918,919],{},"Security → Operational risk"," lists them across repositories. When the end-of-life data changes, Relic\nassesses earlier scans again.",[467,922,923,938,947],{},[470,924,925,749,928,931,932,934,935,937],{},[420,926,927],{},"Matches: End of life",[438,929,930],{},"endOfLife: true",") with a minimum severity of ",[420,933,862],{}," matches cycles\npast end of life; with ",[420,936,880],{},", also those ending within 90 days.",[470,939,940,749,943,946],{},[420,941,942],{},"Matches: Unmaintained",[438,944,945],{},"unmaintained: true",") matches deprecated and unmaintained packages.",[470,948,949,950,953,954,957],{},"To accept a risk, ignore its package URL, such as ",[438,951,952],{},"pkg:pypi\u002Fdjango@4.2.11",", or\n",[438,955,956],{},"pkg:generic\u002Falpine@3.17.4"," for an image's operating system.",[416,959,960],{},"List the end-of-life components in one repository:",[962,963,968],"pre",{"className":964,"code":965,"language":966,"meta":967,"style":967},"language-bash shiki shiki-themes material-theme-lighter github-light-default github-dark-default","relic security risks --kind end_of_life --repository libs-local\n","bash","",[438,969,970],{"__ignoreMap":967},[971,972,975,979,983,986,990,993,996],"span",{"class":973,"line":974},"line",1,[971,976,978],{"class":977},"seIyd","relic",[971,980,982],{"class":981},"sasMN"," security",[971,984,985],{"class":981}," risks",[971,987,989],{"class":988},"smky3"," --kind",[971,991,992],{"class":981}," end_of_life",[971,994,995],{"class":988}," --repository",[971,997,998],{"class":981}," libs-local\n",[459,1000,1002],{"id":1001},"quarantine","Quarantine",[416,1004,1005,1007,1008,1011,1012,1015],{},[429,1006,1002],{}," on a remote repository holds the files it caches until Relic Scan has scanned\nthem and found them not malicious. Only package archives, OS packages, image manifests and\nmodel files are held (",[454,1009,462],{"href":1010},"#what-relic-scan-scans","). A held file answers ",[438,1013,1014],{},"403"," with the reason and cannot be\ncopied or moved. A clean scan releases it, as does a later match that withdraws its malicious\nfinding.",[416,1017,1018,1021],{},[429,1019,1020],{},"Security → Quarantine"," lists held files: awaiting scan, scan failed, scan skipped (over\n2 GiB), malicious or rejected. An administrator can release a file, to serve it whatever its\nscan says, or reject it, to never serve it.",[416,1023,1024],{},"List the held files:",[962,1026,1028],{"className":964,"code":1027,"language":966,"meta":967,"style":967},"relic security quarantine list\n",[438,1029,1030],{"__ignoreMap":967},[971,1031,1032,1034,1036,1039],{"class":973,"line":974},[971,1033,978],{"class":977},[971,1035,982],{"class":981},[971,1037,1038],{"class":981}," quarantine",[971,1040,1041],{"class":981}," list\n",[416,1043,1044],{},"Release one file:",[962,1046,1048],{"className":964,"code":1047,"language":966,"meta":967,"style":967},"relic security quarantine release maven-remote\u002Forg\u002Facme\u002Flib\u002F1.0\u002Flib-1.0.jar --reason \"reviewed\"\n",[438,1049,1050],{"__ignoreMap":967},[971,1051,1052,1054,1056,1058,1061,1064,1067,1071,1074],{"class":973,"line":974},[971,1053,978],{"class":977},[971,1055,982],{"class":981},[971,1057,1038],{"class":981},[971,1059,1060],{"class":981}," release",[971,1062,1063],{"class":981}," maven-remote\u002Forg\u002Facme\u002Flib\u002F1.0\u002Flib-1.0.jar",[971,1065,1066],{"class":988}," --reason",[971,1068,1070],{"class":1069},"sX5mu"," \"",[971,1072,1073],{"class":981},"reviewed",[971,1075,1076],{"class":1069},"\"\n",[416,1078,1079],{},"A released file is still checked against the watches covering its repository.",[459,1081,1083],{"id":1082},"conditions","Conditions",[416,1085,1086,1087,1092],{},"A security rule can have a ",[454,1088,1091],{"href":1089,"rel":1090},"https:\u002F\u002Fcel.dev",[747],"CEL"," condition, with these variables:",[830,1094,1095,1105],{},[833,1096,1097],{},[836,1098,1099,1102],{},[839,1100,1101],{},"About",[839,1103,1104],{},"Variables",[849,1106,1107,1166,1178],{},[836,1108,1109,1112],{},[854,1110,1111],{},"The finding or issue",[854,1113,1114,432,1117,432,1120,432,1123,432,1126,432,1129,432,1132,432,1135,432,1138,432,1141,432,1144,432,1147,432,1150,749,1153,432,1155,1158,1159,1162,1163],{},[438,1115,1116],{},"id",[438,1118,1119],{},"cves",[438,1121,1122],{},"severity",[438,1124,1125],{},"cvss",[438,1127,1128],{},"fixable",[438,1130,1131],{},"malicious",[438,1133,1134],{},"package_name",[438,1136,1137],{},"version",[438,1139,1140],{},"purl",[438,1142,1143],{},"analyzer",[438,1145,1146],{},"rule",[438,1148,1149],{},"file",[438,1151,1152],{},"reachable",[438,1154,1152],{},[438,1156,1157],{},"not_reachable"," or ",[438,1160,1161],{},"unknown","), ",[438,1164,1165],{},"secret_live",[836,1167,1168,1171],{},[854,1169,1170],{},"Operational risks",[854,1172,1173,432,1176],{},[438,1174,1175],{},"eol",[438,1177,894],{},[836,1179,1180,1183],{},[854,1181,1182],{},"Where it was found",[854,1184,1185,432,1188,432,1191],{},[438,1186,1187],{},"repository",[438,1189,1190],{},"path",[438,1192,1193],{},"build",[416,1195,1196],{},"With another criterion, such as a minimum severity, the condition narrows it; alone, the\ncondition decides.",[962,1198,1202],{"className":1199,"code":1200,"language":1201,"meta":967,"style":967},"language-yaml shiki shiki-themes material-theme-lighter github-light-default github-dark-default","rules:\n  - name: critical-outside-our-code\n    minSeverity: critical\n    condition: '!purl.startsWith(\"pkg:maven\u002Fcom.example\u002F\")'\n    failBuild: true\n  - name: secrets-outside-tests\n    condition: 'analyzer == \"secrets\" && !file.endsWith(\"_test.go\")'\n    blockDownload: true\n","yaml",[438,1203,1204,1214,1229,1240,1257,1269,1281,1295],{"__ignoreMap":967},[971,1205,1206,1210],{"class":973,"line":974},[971,1207,1209],{"class":1208},"smKOL","rules",[971,1211,1213],{"class":1212},"sWneD",":\n",[971,1215,1217,1220,1223,1226],{"class":973,"line":1216},2,[971,1218,1219],{"class":1212},"  -",[971,1221,1222],{"class":1208}," name",[971,1224,1225],{"class":1212},":",[971,1227,1228],{"class":981}," critical-outside-our-code\n",[971,1230,1232,1235,1237],{"class":973,"line":1231},3,[971,1233,1234],{"class":1208},"    minSeverity",[971,1236,1225],{"class":1212},[971,1238,1239],{"class":981}," critical\n",[971,1241,1243,1246,1248,1251,1254],{"class":973,"line":1242},4,[971,1244,1245],{"class":1208},"    condition",[971,1247,1225],{"class":1212},[971,1249,1250],{"class":1069}," '",[971,1252,1253],{"class":981},"!purl.startsWith(\"pkg:maven\u002Fcom.example\u002F\")",[971,1255,1256],{"class":1069},"'\n",[971,1258,1260,1263,1265],{"class":973,"line":1259},5,[971,1261,1262],{"class":1208},"    failBuild",[971,1264,1225],{"class":1212},[971,1266,1268],{"class":1267},"sH4kE"," true\n",[971,1270,1272,1274,1276,1278],{"class":973,"line":1271},6,[971,1273,1219],{"class":1212},[971,1275,1222],{"class":1208},[971,1277,1225],{"class":1212},[971,1279,1280],{"class":981}," secrets-outside-tests\n",[971,1282,1284,1286,1288,1290,1293],{"class":973,"line":1283},7,[971,1285,1245],{"class":1208},[971,1287,1225],{"class":1212},[971,1289,1250],{"class":1069},[971,1291,1292],{"class":981},"analyzer == \"secrets\" && !file.endsWith(\"_test.go\")",[971,1294,1256],{"class":1069},[971,1296,1298,1301,1303],{"class":973,"line":1297},8,[971,1299,1300],{"class":1208},"    blockDownload",[971,1302,1225],{"class":1212},[971,1304,1268],{"class":1267},[416,1306,1307],{},"Saving a policy fails when a condition is not valid CEL, names an unknown variable, or does not\nreturn true or false.",[459,1309,1311],{"id":1310},"model-files","Model files",[416,1313,1314,1315,432,1317,432,1319,432,1321,1323,1324,497,1326,432,1328,432,1330,1332,1333,1335,1336,1339],{},"Relic Scan reads, without loading, the pickle streams of ",[438,1316,538],{},[438,1318,541],{},[438,1320,544],{},[438,1322,547],{},", PyTorch files (",[438,1325,550],{},[438,1327,553],{},[438,1329,556],{},[438,1331,559],{},", zip and legacy format) and NumPy object arrays (",[438,1334,562],{},"), and reports\ntheir imports as ",[438,1337,1338],{},"model"," issues. A model file goes to this analyzer alone: Syft, Grype, Gitleaks\nand Trivy do not scan it, so it has no SBOM or vulnerability findings.",[830,1341,1342,1354],{},[833,1343,1344],{},[836,1345,1346,1349,1351],{},[839,1347,1348],{},"Rule",[839,1350,844],{},[839,1352,1353],{},"When",[849,1355,1356,1385,1398],{},[836,1357,1358,1363,1366],{},[854,1359,1360],{},[438,1361,1362],{},"pickle-unsafe-import",[854,1364,1365],{},"critical",[854,1367,1368,1369,432,1372,432,1375,432,1378,432,1381,1384],{},"an import that runs code or reaches the system: ",[438,1370,1371],{},"os.system",[438,1373,1374],{},"subprocess",[438,1376,1377],{},"builtins.eval",[438,1379,1380],{},"exec",[438,1382,1383],{},"socket",", …",[836,1386,1387,1392,1395],{},[854,1388,1389],{},[438,1390,1391],{},"pickle-dynamic-import",[854,1393,1394],{},"high, or medium for an unreadable stream",[854,1396,1397],{},"an import whose name the stream computes, or a stream Relic cannot read",[836,1399,1400,1405,1407],{},[854,1401,1402],{},[438,1403,1404],{},"pickle-unknown-import",[854,1406,902],{},[854,1408,1409],{},"an import outside the libraries models use (PyTorch, NumPy, scikit-learn, …)",[416,1411,1412,1413,1416],{},"Policies treat these like other issues: a rule with a minimum severity of critical blocks a\nmalicious model. Prefer ",[438,1414,1415],{},"safetensors",", which holds no code.",[459,1418,1420],{"id":1419},"secrets-and-misconfigurations","Secrets and misconfigurations",[830,1422,1423,1436],{},[833,1424,1425],{},[836,1426,1427,1430,1433],{},[839,1428,1429],{},"Kind",[839,1431,1432],{},"Found by",[839,1434,1435],{},"What",[849,1437,1438,1453],{},[836,1439,1440,1443,1450],{},[854,1441,1442],{},"Secrets",[854,1444,1445],{},[454,1446,1449],{"href":1447,"rel":1448},"https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks",[747],"gitleaks",[854,1451,1452],{},"keys, tokens and passwords in files, also inside archives. Relic records the rule, file and line, never the secret.",[836,1454,1455,1458,1466],{},[854,1456,1457],{},"Misconfigurations",[854,1459,1460,1465],{},[454,1461,1464],{"href":1462,"rel":1463},"https:\u002F\u002Ftrivy.dev",[747],"Trivy",", with its built-in checks",[854,1467,1468],{},"Helm charts, Kubernetes manifests, Terraform modules, Dockerfiles and image configuration (a privileged container, a missing resource limit, an image running as root, …)",[416,1470,1471,1472,432,1475,1478,1479,1482,1483,1485,1486,1489,1490,1158,1493,749,1495,497,1498,563],{},"Each analyzer is off when its binary (",[438,1473,1474],{},"RELIC_SCAN_GITLEAKS_PATH",[438,1476,1477],{},"RELIC_SCAN_TRIVY_PATH",") is\nmissing. The issues appear under ",[420,1480,1481],{},"Secrets, misconfigurations, licenses and model code in\nfiles"," on an artifact's ",[429,1484,255],{}," tab, and in ",[438,1487,1488],{},"relic security report \u003Crepository>\u002F\u003Cpath>",".\nA policy rule matches them with ",[420,1491,1492],{},"Matches: Secrets",[420,1494,1457],{},[438,1496,1497],{},"secrets: true",[438,1499,1500],{},"misconfigurations: true",[1502,1503,1505],"h3",{"id":1504},"secret-validation","Secret validation",[416,1507,1508,1509,1512],{},"With ",[438,1510,1511],{},"RELIC_SECRET_VALIDATION_ENABLED=true",", the worker asks each secret's provider whether it\nstill accepts it. It is off by default, because it sends each secret to its provider.",[830,1514,1515,1528],{},[833,1516,1517],{},[836,1518,1519,1522,1525],{},[839,1520,1521],{},"Provider",[839,1523,1524],{},"Secrets (gitleaks rules)",[839,1526,1527],{},"Request",[849,1529,1530,1543,1556,1569,1582],{},[836,1531,1532,1535,1538],{},[854,1533,1534],{},"GitHub",[854,1536,1537],{},"personal, fine-grained, OAuth and app tokens",[854,1539,1540],{},[438,1541,1542],{},"GET https:\u002F\u002Fapi.github.com\u002Fuser",[836,1544,1545,1548,1551],{},[854,1546,1547],{},"GitLab",[854,1549,1550],{},"personal access tokens",[854,1552,1553],{},[438,1554,1555],{},"GET https:\u002F\u002Fgitlab.com\u002Fapi\u002Fv4\u002Fpersonal_access_tokens\u002Fself",[836,1557,1558,1561,1564],{},[854,1559,1560],{},"Slack",[854,1562,1563],{},"bot and user tokens",[854,1565,1566],{},[438,1567,1568],{},"POST https:\u002F\u002Fslack.com\u002Fapi\u002Fauth.test",[836,1570,1571,1574,1577],{},[854,1572,1573],{},"npm",[854,1575,1576],{},"access tokens",[854,1578,1579],{},[438,1580,1581],{},"GET https:\u002F\u002Fregistry.npmjs.org\u002F-\u002Fwhoami",[836,1583,1584,1587,1590],{},[854,1585,1586],{},"Stripe",[854,1588,1589],{},"secret and restricted keys",[854,1591,1592],{},[438,1593,1594],{},"GET https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Faccount",[416,1596,1597],{},"The issue records the outcome:",[467,1599,1600,1608,1614,1622],{},[470,1601,1602,1605,1606,457],{},[429,1603,1604],{},"Live",": the provider accepts the secret. The issue becomes ",[420,1607,1365],{},[470,1609,1610,1613],{},[429,1611,1612],{},"Inactive",": Slack, npm or Stripe refuses it.",[470,1615,1616,749,1619,1621],{},[429,1617,1618],{},"Not confirmed",[438,1620,1161],{},"): no provider answers for the rule (AWS keys, private keys,\ngeneric passwords), or a GitHub or GitLab refusal, which a self-hosted server's token also\ngets.",[470,1623,1624,749,1627,1630],{},[429,1625,1626],{},"Check failed",[438,1628,1629],{},"error","): the provider did not answer.",[416,1632,1633,1634,1637,1638,1641,1642,1645,1646,749,1649,1652],{},"Relic contacts only these hosts, never stores the secret, and audits each check\n(",[438,1635,1636],{},"secret.validated","). Checks are half a second apart, at most 50\nper scan. ",[438,1639,1640],{},"RELIC_SECRET_VALIDATION_PROVIDERS"," limits the providers, for example ",[438,1643,1644],{},"github,npm",".\n",[420,1647,1648],{},"Matches: Live secrets",[438,1650,1651],{},"liveSecrets: true",") matches live secrets only.",[459,1654,1656],{"id":1655},"deep-license-scanning","Deep license scanning",[416,1658,1659,1660,1665,1666,1669,1670,1673],{},"To find licenses in file text, such as a vendored GPL source file, install the\n",[454,1661,1664],{"href":1662,"rel":1663},"https:\u002F\u002Fgithub.com\u002Faboutcode-org\u002Fscancode-toolkit",[747],"ScanCode toolkit"," beside the worker and\nset ",[438,1667,1668],{},"RELIC_SCAN_SCANCODE_PATH"," to its ",[438,1671,1672],{},"scancode"," binary. It is off by default, and slow. Relic\nlists each license with its file and line, and license policies treat it like a package's own.",[459,1675,1677],{"id":1676},"sboms","SBOMs",[416,1679,1680,1683,1684,1686],{},[429,1681,1682],{},"Export SBOM"," on the ",[429,1685,724],{}," tab downloads the components as CycloneDX 1.6, SPDX 2.3 or\nSyft JSON.",[416,1688,1689],{},"Export an item's SBOM as SPDX:",[962,1691,1693],{"className":964,"code":1692,"language":966,"meta":967,"style":967},"relic security sbom export libs-local\u002Fapp\u002Fapp-1.4.0.jar --format spdx --file app.spdx.json\n",[438,1694,1695],{"__ignoreMap":967},[971,1696,1697,1699,1701,1704,1707,1710,1713,1716,1719],{"class":973,"line":974},[971,1698,978],{"class":977},[971,1700,982],{"class":981},[971,1702,1703],{"class":981}," sbom",[971,1705,1706],{"class":981}," export",[971,1708,1709],{"class":981}," libs-local\u002Fapp\u002Fapp-1.4.0.jar",[971,1711,1712],{"class":988}," --format",[971,1714,1715],{"class":981}," spdx",[971,1717,1718],{"class":988}," --file",[971,1720,1721],{"class":981}," app.spdx.json\n",[416,1723,1724,1725,1728],{},"A build can upload its own SBOM (CycloneDX, SPDX or Syft JSON). It replaces the SBOM of the\nitem's content, and Relic matches it again. Until the match finishes, the scan is queued, so\n",[438,1726,1727],{},"relic security report"," does not report a clean result early. Every file with that content shares the SBOM, so\nthis needs deploy permission on each of them, or an administrator.",[416,1730,1731],{},"Import an SBOM for an item:",[962,1733,1735],{"className":964,"code":1734,"language":966,"meta":967,"style":967},"relic security sbom import libs-local\u002Fapp\u002Fapp-1.4.0.jar build\u002Fbom.cdx.json\n",[438,1736,1737],{"__ignoreMap":967},[971,1738,1739,1741,1743,1745,1748,1750],{"class":973,"line":974},[971,1740,978],{"class":977},[971,1742,982],{"class":981},[971,1744,1703],{"class":981},[971,1746,1747],{"class":981}," import",[971,1749,1709],{"class":981},[971,1751,1752],{"class":981}," build\u002Fbom.cdx.json\n",[416,1754,1755,1756,436,1759,457],{},"The Relic API routes are ",[438,1757,1758],{},"GET",[438,1760,1761],{},"PUT \u002Fapi\u002Fv1\u002Fsbom\u002F\u003Crepo>\u002F\u003Cpath>",[459,1763,1765],{"id":1764},"vex","VEX",[416,1767,1768,1769,436,1774,1779],{},"Relic exchanges ignore rules as ",[454,1770,1773],{"href":1771,"rel":1772},"https:\u002F\u002Fopenvex.dev",[747],"OpenVEX",[454,1775,1778],{"href":1776,"rel":1777},"https:\u002F\u002Fcyclonedx.org\u002Fcapabilities\u002Fvex\u002F",[747],"CycloneDX"," VEX documents.",[467,1781,1782,1803,1824],{},[470,1783,1784,1787,1788,1791,1792,1795,1796,1799,1800,457],{},[429,1785,1786],{},"Export VEX"," on ",[429,1789,1790],{},"Security → Ignore rules",", or ",[438,1793,1794],{},"relic security vex export",", writes a\n",[438,1797,1798],{},"not_affected"," statement for each vulnerability a rule ignores in packages: OpenVEX, or\nCycloneDX 1.6 with ",[438,1801,1802],{},"--format cyclonedx",[470,1804,1805,749,1808,1811,1812,1816,1817,1820,1821,563],{},[420,1806,1807],{},"With the Go vulnerabilities no code calls",[438,1809,1810],{},"--unreachable",") adds the\n",[454,1813,1815],{"href":1814},"#reachability-go","unreachable"," Go vulnerabilities, per scanned file, with the justification\n",[438,1818,1819],{},"vulnerable_code_not_in_execute_path"," (CycloneDX: ",[438,1822,1823],{},"code_not_reachable",[470,1825,1826,1791,1829,1832,1833,513,1835,1838,1839,432,1841,1844,1845,1848],{},[429,1827,1828],{},"Import VEX",[438,1830,1831],{},"relic security vex import",", turns ",[438,1834,1798],{},[438,1836,1837],{},"fixed"," statements\n(CycloneDX: ",[438,1840,1798],{},[438,1842,1843],{},"resolved",") into ignore rules on the packages they name, by\npackage URL or, in CycloneDX, by ",[438,1846,1847],{},"bom-ref"," or BOM-Link. The rule notes the document, its\nauthor and the importing user. A statement whose rule is already stored creates no\nsecond one.",[416,1850,1851,1852,513,1855,1820,1858,432,1861,497,1864,1867],{},"Import skips ",[420,1853,1854],{},"affected",[420,1856,1857],{},"under investigation",[420,1859,1860],{},"exploitable",[420,1862,1863],{},"in triage",[420,1865,1866],{},"false positive","). Export skips rules VEX cannot express: without a vulnerability or a\npackage, limited to licenses, watches, policies, paths or builds, or expiring (waivers\nincluded). Both report how many they skipped.",[459,1869,1871],{"id":1870},"package-lookups","Package lookups",[416,1873,1874],{},"A package does not always carry its license: a Go module in an executable has none, and a jar\noften leaves it to a parent POM. Lookups fetch what is missing. They are off by default because\neach one sends a package's name and version to the URL you set.",[416,1876,1877],{},"Set a URL for each ecosystem you want looked up:",[830,1879,1880,1893],{},[833,1881,1882],{},[836,1883,1884,1887,1890],{},[839,1885,1886],{},"Variable",[839,1888,1889],{},"Lookup",[839,1891,1892],{},"Requests",[849,1894,1895,1910,1925,1940],{},[836,1896,1897,1902,1905],{},[854,1898,1899],{},[438,1900,1901],{},"RELIC_SCAN_MAVEN_URL",[854,1903,1904],{},"POMs and parent POMs, for licenses and versions",[854,1906,1907],{},[438,1908,1909],{},"\u003Curl>\u002F\u003Cgroup path>\u002F\u003Cartifact>\u002F\u003Cversion>\u002F\u003Cartifact>-\u003Cversion>.pom",[836,1911,1912,1917,1920],{},[854,1913,1914],{},[438,1915,1916],{},"RELIC_SCAN_PYPI_URL",[854,1918,1919],{},"Python licenses, for packages in requirements and lock files",[854,1921,1922],{},[438,1923,1924],{},"\u003Curl>\u002F\u003Cname>\u002F\u003Cversion>\u002Fjson",[836,1926,1927,1932,1935],{},[854,1928,1929],{},[438,1930,1931],{},"RELIC_SCAN_NPM_URL",[854,1933,1934],{},"npm licenses, for packages in lock files",[854,1936,1937],{},[438,1938,1939],{},"\u003Curl>\u002F\u003Cname>\u002F\u003Cversion>",[836,1941,1942,1947,1950],{},[854,1943,1944],{},[438,1945,1946],{},"RELIC_SCAN_GO_PROXY_URL",[854,1948,1949],{},"Go licenses",[854,1951,1952],{},[438,1953,1954],{},"\u003Curl>\u002F\u003Cmodule>\u002F@v\u002F\u003Cversion>.zip",[467,1956,1957,1963,1966,1969,1972],{},[470,1958,1959,1960,1962],{},"Point ",[438,1961,1901],{}," at a mirror: Maven Central can refuse Syft's requests.",[470,1964,1965],{},"A URL takes no credentials, so the mirror must allow anonymous reads. Relic refuses to start\nwith credentials in one.",[470,1967,1968],{},"The scanners do not read the worker's proxy settings, and they trust the system's CA\ncertificates only. The mirror must be directly reachable with a certificate those roots accept.",[470,1970,1971],{},"A lookup that fails leaves that license unknown, and the scan continues.",[470,1973,1974],{},"Lookups run when Relic makes an SBOM. SBOMs already stored keep the licenses they have.",[459,1976,1978],{"id":1977},"without-internet-access","Without Internet access",[416,1980,1981,1982,1985],{},"The worker downloads the vulnerability database at start and every 12 hours. A database that\nfails its checksum is deleted and downloaded again; scans wait meanwhile. With\n",[438,1983,1984],{},"RELIC_SCAN_VULNERABILITY_DATABASE_URL=off",", scans wait until you import one. A scan whose\nmatch against the database fails three times is recorded as failed, with Grype's error, and\nthe worker scans it again once a database download or import succeeds. Offline, either:",[467,1987,1988,2002],{},[470,1989,1990,1991,1994,1995,1998,1999,2001],{},"copy Grype's ",[438,1992,1993],{},"latest.json"," and the archive it names, for example into a generic repository,\nand point ",[438,1996,1997],{},"RELIC_SCAN_VULNERABILITY_DATABASE_URL"," at the copied ",[438,2000,1993],{},"; or",[470,2003,2004,2005,2008],{},"set it to ",[438,2006,2007],{},"off"," and import databases by hand.",[416,2010,2011,2014],{},[454,2012,1871],{"href":2013},"#package-lookups"," are off unless you set them; point them at mirrors inside the\nnetwork.",[416,2016,2017],{},"On a machine with Internet access, set the database base URL:",[962,2019,2021],{"className":964,"code":2020,"language":966,"meta":967,"style":967},"base=https:\u002F\u002Fgrype.anchore.io\u002Fdatabases\u002Fv6\n",[438,2022,2023],{"__ignoreMap":967},[971,2024,2025,2029,2033],{"class":973,"line":974},[971,2026,2028],{"class":2027},"saDVj","base",[971,2030,2032],{"class":2031},"s8eFF","=",[971,2034,2035],{"class":981},"https:\u002F\u002Fgrype.anchore.io\u002Fdatabases\u002Fv6\n",[416,2037,2038],{},"Download the latest database archive:",[962,2040,2042],{"className":964,"code":2041,"language":966,"meta":967,"style":967},"curl -fsSLo grype-db.tar.zst \"$base\u002F$(curl -fsS $base\u002Flatest.json | jq -r .path)\"\n",[438,2043,2044],{"__ignoreMap":967},[971,2045,2046,2049,2052,2055,2057,2060,2063,2066,2068,2071,2074,2077,2080,2083,2086,2089],{"class":973,"line":974},[971,2047,2048],{"class":977},"curl",[971,2050,2051],{"class":988}," -fsSLo",[971,2053,2054],{"class":981}," grype-db.tar.zst",[971,2056,1070],{"class":1069},[971,2058,2059],{"class":2027},"$base",[971,2061,2062],{"class":981},"\u002F",[971,2064,2065],{"class":1069},"$(",[971,2067,2048],{"class":977},[971,2069,2070],{"class":988}," -fsS",[971,2072,2073],{"class":2027}," $base",[971,2075,2076],{"class":981},"\u002Flatest.json ",[971,2078,2079],{"class":2031},"|",[971,2081,2082],{"class":977}," jq",[971,2084,2085],{"class":988}," -r",[971,2087,2088],{"class":981}," .path",[971,2090,2091],{"class":1069},")\"\n",[416,2093,2094],{},"Inside the network, import it as an administrator:",[962,2096,2098],{"className":964,"code":2097,"language":966,"meta":967,"style":967},"relic security database import grype-db.tar.zst\n",[438,2099,2100],{"__ignoreMap":967},[971,2101,2102,2104,2106,2109,2111],{"class":973,"line":974},[971,2103,978],{"class":977},[971,2105,982],{"class":981},[971,2107,2108],{"class":981}," database",[971,2110,1747],{"class":981},[971,2112,2113],{"class":981}," grype-db.tar.zst\n",[416,2115,2116],{},"Check the database status:",[962,2118,2120],{"className":964,"code":2119,"language":966,"meta":967,"style":967},"relic security database status\n",[438,2121,2122],{"__ignoreMap":967},[971,2123,2124,2126,2128,2130],{"class":973,"line":974},[971,2125,978],{"class":977},[971,2127,982],{"class":981},[971,2129,2108],{"class":981},[971,2131,2132],{"class":981}," status\n",[416,2134,2135,1787,2138,2140],{},[429,2136,2137],{},"Import vulnerability database",[429,2139,435],{}," does the same.",[416,2142,2143,2144,497,2147,432,2149,1158,2151,2154,2155,2157],{},"The server refuses a file that does not start like an archive Grype imports (",[438,2145,2146],{},".tar.zst",[438,2148,487],{},[438,2150,493],{},[438,2152,2153],{},".tar","), and refuses any import while Relic Scan is off. When the\nworker fails to install an archive, the status command and ",[429,2156,435],{}," show\nthe error until a later import succeeds.",[416,2159,2160,2161,2164,2165,2167],{},"For Go reachability, copy ",[438,2162,2163],{},"https:\u002F\u002Fvuln.go.dev\u002Fvulndb.zip"," to a generic repository and point\n",[438,2166,820],{}," at the copy.",[416,2169,2170,2171,2174,2175,2177],{},"For end-of-life data, point ",[438,2172,2173],{},"RELIC_END_OF_LIFE_URL"," at a copy, or set it to ",[438,2176,2007],{}," and import\nit. On a machine with Internet access, download it:",[962,2179,2181],{"className":964,"code":2180,"language":966,"meta":967,"style":967},"curl -fsSLo eol.json https:\u002F\u002Fendoflife.date\u002Fapi\u002Fv1\u002Fproducts\u002Ffull\n",[438,2182,2183],{"__ignoreMap":967},[971,2184,2185,2187,2189,2192],{"class":973,"line":974},[971,2186,2048],{"class":977},[971,2188,2051],{"class":988},[971,2190,2191],{"class":981}," eol.json",[971,2193,2194],{"class":981}," https:\u002F\u002Fendoflife.date\u002Fapi\u002Fv1\u002Fproducts\u002Ffull\n",[416,2196,2094],{},[962,2198,2200],{"className":964,"code":2199,"language":966,"meta":967,"style":967},"relic security end-of-life import eol.json\n",[438,2201,2202],{"__ignoreMap":967},[971,2203,2204,2206,2208,2211,2213],{"class":973,"line":974},[971,2205,978],{"class":977},[971,2207,982],{"class":981},[971,2209,2210],{"class":981}," end-of-life",[971,2212,1747],{"class":981},[971,2214,2215],{"class":981}," eol.json\n",[416,2217,2218],{},"Check what the server holds:",[962,2220,2222],{"className":964,"code":2221,"language":966,"meta":967,"style":967},"relic security end-of-life status\n",[438,2223,2224],{"__ignoreMap":967},[971,2225,2226,2228,2230,2232],{"class":973,"line":974},[971,2227,978],{"class":977},[971,2229,982],{"class":981},[971,2231,2210],{"class":981},[971,2233,2132],{"class":981},[459,2235,2237],{"id":2236},"policies-and-watches","Policies and watches",[467,2239,2240,2243,2246],{},[470,2241,2242],{},"A policy defines violations: a minimum severity, or licenses. It can fail builds and block\ndownloads.",[470,2244,2245],{},"A watch applies policies to local and remote repositories, or builds. A download through a\nvirtual repository is checked against the member that stores the file, so a watch cannot\nname a virtual repository, or one that does not exist.",[470,2247,2248,2249,432,2252,2254],{},"A rule that blocks downloads can also block content without a successful scan\n(",[438,2250,2251],{},"blockUnscanned",[429,2253,693],{},"): not scanned yet,\nfailed, or skipped (over 2 GiB). A skipped file stays blocked while the rule covers it. The\nrule applies to package archives, OS packages, image manifests and model files only.",[1502,2256,2258],{"id":2257},"license-policies","License policies",[416,2260,2261],{},"A license rule bans or allows SPDX licenses. Relic evaluates each component's SPDX expression:",[830,2263,2264,2283],{},[833,2265,2266],{},[836,2267,2268,2271,2277],{},[839,2269,2270],{},"Component license",[839,2272,2273,2274],{},"Banned ",[438,2275,2276],{},"GPL-3.0-only",[839,2278,2279,2280],{},"Allowed ",[438,2281,2282],{},"MIT",[849,2284,2285,2298,2311],{},[836,2286,2287,2292,2295],{},[854,2288,2289],{},[438,2290,2291],{},"MIT OR GPL-3.0-only",[854,2293,2294],{},"no violation: MIT can be chosen",[854,2296,2297],{},"no violation",[836,2299,2300,2305,2308],{},[854,2301,2302],{},[438,2303,2304],{},"MIT AND GPL-3.0-only",[854,2306,2307],{},"violation",[854,2309,2310],{},"violation: GPL-3.0-only is required",[836,2312,2313,2318,2321],{},[854,2314,2315],{},[438,2316,2317],{},"GPL-3.0-or-later",[854,2319,2320],{},"violation: a ban covers every version form",[854,2322,2307],{},[467,2324,2325,2328,2334],{},[470,2326,2327],{},"A license not mapped to SPDX is compared by name, ignoring case.",[470,2329,2330,2331,457],{},"A component without a license is allowed, unless the rule turns off ",[429,2332,2333],{},"Allow components\nwithout a known license",[470,2335,2336,2337,2340],{},"License policies apply to scanned artifacts. Build scans (",[438,2338,2339],{},"relic build scan",") report only\nvulnerabilities.",[1502,2342,2344],{"id":2343},"policies-as-code","Policies as code",[416,2346,2347,2348,2351],{},"A preview evaluates ",[438,2349,2350],{},"relic.build\u002Fv1"," policies against stored findings, without saving them,\nand lists the files they would raise violations on.",[962,2353,2355],{"className":1199,"code":2354,"language":1201,"meta":967,"style":967},"apiVersion: relic.build\u002Fv1\nkind: Policy\nmetadata: {name: no-critical}\nspec:\n  kind: security\n  rules:\n    - {name: critical, minSeverity: critical, failBuild: true, blockDownload: true}\n",[438,2356,2357,2367,2377,2398,2405,2415,2422],{"__ignoreMap":967},[971,2358,2359,2362,2364],{"class":973,"line":974},[971,2360,2361],{"class":1208},"apiVersion",[971,2363,1225],{"class":1212},[971,2365,2366],{"class":981}," relic.build\u002Fv1\n",[971,2368,2369,2372,2374],{"class":973,"line":1216},[971,2370,2371],{"class":1208},"kind",[971,2373,1225],{"class":1212},[971,2375,2376],{"class":981}," Policy\n",[971,2378,2379,2382,2384,2387,2390,2392,2395],{"class":973,"line":1231},[971,2380,2381],{"class":1208},"metadata",[971,2383,1225],{"class":1212},[971,2385,2386],{"class":1212}," {",[971,2388,2389],{"class":1208},"name",[971,2391,1225],{"class":1212},[971,2393,2394],{"class":981}," no-critical",[971,2396,2397],{"class":1212},"}\n",[971,2399,2400,2403],{"class":973,"line":1242},[971,2401,2402],{"class":1208},"spec",[971,2404,1213],{"class":1212},[971,2406,2407,2410,2412],{"class":973,"line":1259},[971,2408,2409],{"class":1208},"  kind",[971,2411,1225],{"class":1212},[971,2413,2414],{"class":981}," security\n",[971,2416,2417,2420],{"class":973,"line":1271},[971,2418,2419],{"class":1208},"  rules",[971,2421,1213],{"class":1212},[971,2423,2424,2427,2429,2431,2433,2436,2439,2442,2444,2446,2448,2451,2453,2456,2458,2461,2463,2465],{"class":973,"line":1283},[971,2425,2426],{"class":1212},"    -",[971,2428,2386],{"class":1212},[971,2430,2389],{"class":1208},[971,2432,1225],{"class":1212},[971,2434,2435],{"class":981}," critical",[971,2437,2438],{"class":1212},",",[971,2440,2441],{"class":1208}," minSeverity",[971,2443,1225],{"class":1212},[971,2445,2435],{"class":981},[971,2447,2438],{"class":1212},[971,2449,2450],{"class":1208}," failBuild",[971,2452,1225],{"class":1212},[971,2454,2455],{"class":1267}," true",[971,2457,2438],{"class":1212},[971,2459,2460],{"class":1208}," blockDownload",[971,2462,1225],{"class":1212},[971,2464,2455],{"class":1267},[971,2466,2397],{"class":1212},[416,2468,2469],{},"Preview the policies:",[962,2471,2473],{"className":964,"code":2472,"language":966,"meta":967,"style":967},"relic security policy preview -f policies.yaml\n",[438,2474,2475],{"__ignoreMap":967},[971,2476,2477,2479,2481,2484,2487,2490],{"class":973,"line":974},[971,2478,978],{"class":977},[971,2480,982],{"class":981},[971,2482,2483],{"class":981}," policy",[971,2485,2486],{"class":981}," preview",[971,2488,2489],{"class":988}," -f",[971,2491,2492],{"class":981}," policies.yaml\n",[416,2494,2495],{},"Apply them:",[962,2497,2499],{"className":964,"code":2498,"language":966,"meta":967,"style":967},"relic apply -f policies.yaml\n",[438,2500,2501],{"__ignoreMap":967},[971,2502,2503,2505,2508,2510],{"class":973,"line":974},[971,2504,978],{"class":977},[971,2506,2507],{"class":981}," apply",[971,2509,2489],{"class":988},[971,2511,2492],{"class":981},[1502,2513,2515],{"id":2514},"decisions","Decisions",[416,2517,2518,2521],{},[429,2519,2520],{},"Security → Decisions"," lists every blocking decision: blocked downloads, builds a scan fails,\nand promotions a gate refuses. Each names the subject, policy, watch, rule, reason, requester\nand count.",[416,2523,2524],{},"List the blocked downloads:",[962,2526,2528],{"className":964,"code":2527,"language":966,"meta":967,"style":967},"relic security decisions --kind download\n",[438,2529,2530],{"__ignoreMap":967},[971,2531,2532,2534,2536,2539,2541],{"class":973,"line":974},[971,2533,978],{"class":977},[971,2535,982],{"class":981},[971,2537,2538],{"class":981}," decisions",[971,2540,989],{"class":988},[971,2542,2543],{"class":981}," download\n",[459,2545,2547],{"id":2546},"ignore-rules","Ignore rules",[416,2549,2550,2551,2553,2554,457],{},"An ignore rule stops a finding from counting as a violation. A license rule covers every\nexpression naming the license: ignoring ",[438,2552,2276],{}," also covers ",[438,2555,2304],{},[459,2557,2559],{"id":2558},"waivers","Waivers",[416,2561,2562,2563,2566],{},"Any signed-in user can request a waiver: an ignore rule for a package, vulnerabilities or\nlicenses, with a reason. Administrators approve it for 1 to 365 days, creating an ignore rule\nthat expires then, or reject it with a note. ",[429,2564,2565],{},"Security → Waivers"," lists your waivers;\nadministrators and viewers see everyone's.",[416,2568,2569],{},"Request a waiver:",[962,2571,2573],{"className":964,"code":2572,"language":966,"meta":967,"style":967},"relic security waiver request --package pkg:npm\u002Flodash@4.17.15 --vulnerability CVE-2020-8203 --reason \"the vulnerable function is not reachable\"\n",[438,2574,2575],{"__ignoreMap":967},[971,2576,2577,2579,2581,2584,2587,2590,2593,2596,2599,2601,2603,2606],{"class":973,"line":974},[971,2578,978],{"class":977},[971,2580,982],{"class":981},[971,2582,2583],{"class":981}," waiver",[971,2585,2586],{"class":981}," request",[971,2588,2589],{"class":988}," --package",[971,2591,2592],{"class":981}," pkg:npm\u002Flodash@4.17.15",[971,2594,2595],{"class":988}," --vulnerability",[971,2597,2598],{"class":981}," CVE-2020-8203",[971,2600,1066],{"class":988},[971,2602,1070],{"class":1069},[971,2604,2605],{"class":981},"the vulnerable function is not reachable",[971,2607,1076],{"class":1069},[416,2609,2610],{},"List the pending waivers, 50 per page, newest first:",[962,2612,2614],{"className":964,"code":2613,"language":966,"meta":967,"style":967},"relic security waiver list --status pending\n",[438,2615,2616],{"__ignoreMap":967},[971,2617,2618,2620,2622,2624,2627,2630],{"class":973,"line":974},[971,2619,978],{"class":977},[971,2621,982],{"class":981},[971,2623,2583],{"class":981},[971,2625,2626],{"class":981}," list",[971,2628,2629],{"class":988}," --status",[971,2631,2632],{"class":981}," pending\n",[416,2634,2635],{},"List the next page:",[962,2637,2639],{"className":964,"code":2638,"language":966,"meta":967,"style":967},"relic security waiver list --status pending --page 2\n",[438,2640,2641],{"__ignoreMap":967},[971,2642,2643,2645,2647,2649,2651,2653,2656,2659],{"class":973,"line":974},[971,2644,978],{"class":977},[971,2646,982],{"class":981},[971,2648,2583],{"class":981},[971,2650,2626],{"class":981},[971,2652,2629],{"class":988},[971,2654,2655],{"class":981}," pending",[971,2657,2658],{"class":988}," --page",[971,2660,2662],{"class":2661},"sIO_5"," 2\n",[416,2664,2665],{},"Approve one for 30 days:",[962,2667,2669],{"className":964,"code":2668,"language":966,"meta":967,"style":967},"relic security waiver approve 0192f7a0-5d1e-7c3a-9b2f-6e4d8a1c0b7e --days 30 --note \"until the upgrade\"\n",[438,2670,2671],{"__ignoreMap":967},[971,2672,2673,2675,2677,2679,2682,2685,2688,2691,2694,2696,2699],{"class":973,"line":974},[971,2674,978],{"class":977},[971,2676,982],{"class":981},[971,2678,2583],{"class":981},[971,2680,2681],{"class":981}," approve",[971,2683,2684],{"class":981}," 0192f7a0-5d1e-7c3a-9b2f-6e4d8a1c0b7e",[971,2686,2687],{"class":988}," --days",[971,2689,2690],{"class":2661}," 30",[971,2692,2693],{"class":988}," --note",[971,2695,1070],{"class":1069},[971,2697,2698],{"class":981},"until the upgrade",[971,2700,1076],{"class":1069},[459,2702,334],{"id":2703},"cli",[416,2705,2706,2709,2710,2713,2714,2716,2717,702,2719,2721],{},[438,2707,2708],{},"relic security audit"," scans a project's dependencies, ",[438,2711,2712],{},"relic security scan"," files, images\nand SBOMs, and ",[438,2715,2339],{}," a published build, all with the server's database and\npolicies. See ",[454,2718,366],{"href":367},[454,2720,277],{"href":278}," to rank findings by risk.",[2723,2724,2725],"style",{},"html pre.shiki code .seIyd, html code.shiki .seIyd{--shiki-light:#E2931D;--shiki-default:#953800;--shiki-dark:#FFA657}html pre.shiki code .sasMN, html code.shiki .sasMN{--shiki-light:#91B859;--shiki-default:#0A3069;--shiki-dark:#A5D6FF}html pre.shiki code .smky3, html code.shiki .smky3{--shiki-light:#91B859;--shiki-default:#0550AE;--shiki-dark:#79C0FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sX5mu, html code.shiki .sX5mu{--shiki-light:#39ADB5;--shiki-default:#0A3069;--shiki-dark:#A5D6FF}html pre.shiki code .smKOL, html code.shiki .smKOL{--shiki-light:#E53935;--shiki-default:#116329;--shiki-dark:#7EE787}html pre.shiki code .sWneD, html code.shiki .sWneD{--shiki-light:#39ADB5;--shiki-default:#1F2328;--shiki-dark:#E6EDF3}html pre.shiki code .sH4kE, html code.shiki .sH4kE{--shiki-light:#FF5370;--shiki-default:#0550AE;--shiki-dark:#79C0FF}html pre.shiki code .saDVj, html code.shiki .saDVj{--shiki-light:#90A4AE;--shiki-default:#1F2328;--shiki-dark:#E6EDF3}html pre.shiki code .s8eFF, html code.shiki .s8eFF{--shiki-light:#39ADB5;--shiki-default:#CF222E;--shiki-dark:#FF7B72}html pre.shiki code .sIO_5, html code.shiki .sIO_5{--shiki-light:#F76D47;--shiki-default:#0550AE;--shiki-dark:#79C0FF}",{"title":967,"searchDepth":1216,"depth":1216,"links":2727},[2728,2729,2730,2731,2732,2733,2734,2735,2736,2739,2740,2741,2742,2743,2744,2749,2750,2751],{"id":461,"depth":1216,"text":462},{"id":709,"depth":1216,"text":710},{"id":738,"depth":1216,"text":739},{"id":773,"depth":1216,"text":774},{"id":824,"depth":1216,"text":825},{"id":1001,"depth":1216,"text":1002},{"id":1082,"depth":1216,"text":1083},{"id":1310,"depth":1216,"text":1311},{"id":1419,"depth":1216,"text":1420,"children":2737},[2738],{"id":1504,"depth":1231,"text":1505},{"id":1655,"depth":1216,"text":1656},{"id":1676,"depth":1216,"text":1677},{"id":1764,"depth":1216,"text":1765},{"id":1870,"depth":1216,"text":1871},{"id":1977,"depth":1216,"text":1978},{"id":2236,"depth":1216,"text":2237,"children":2745},[2746,2747,2748],{"id":2257,"depth":1231,"text":2258},{"id":2343,"depth":1231,"text":2344},{"id":2514,"depth":1231,"text":2515},{"id":2546,"depth":1216,"text":2547},{"id":2558,"depth":1216,"text":2559},{"id":2703,"depth":1216,"text":334},"Scan stored artifacts with Syft and Grype, and enforce policies, watches and ignore rules.","md",null,{},true,{"title":273,"description":2752},"xzIs-P-3aDrPHLliousJqXH3CQr01k7uOyMKfJeaehU",[2760,2762],{"title":269,"path":270,"stem":271,"description":2761,"children":-1},"Scoped access tokens for the relic CLI, CI and the Relic API.",{"title":277,"path":278,"stem":279,"description":2763,"children":-1},"CVE records, CISA SSVC, EPSS and KEV data that rank findings by real-world risk.",1793857357637]