Features
Six scanners. One pipeline. Zero re-architecture.
HarborGuard runs every major open-source container scanner against the same image, deduplicates findings, and routes them through one triage queue. You stop choosing between tools and start using all of them.
Trivy
Comprehensive vulnerability scanner with CVE, license, IaC, and secret detection.
Trivy is the broadest-coverage open-source scanner: OS packages, language deps, IaC misconfig, secrets, and licenses in one binary.
Grype
Vulnerability matcher tuned for SBOM-driven workflows.
Grype consumes SBOMs (typically from Syft) and matches packages against the NVD, GitHub Security Advisories, Alpine secdb, and others.
Syft
SBOM generator covering 25+ ecosystems.
Syft produces a Software Bill of Materials — every package and version inside a container — without phoning home.
Dockle
Container image best-practices linter aligned to CIS Docker.
Dockle catches misconfigurations: writable root, leaked secrets, latest tags, and CIS Docker Benchmark violations.
OSV-Scanner
Open Source Vulnerability database scanner from Google.
OSV-Scanner cross-references your dependencies against the OSV.dev database — the same feed Google uses for its own supply-chain protection.
Dive
Layer-by-layer image efficiency analyzer.
Dive tells you exactly what each Docker layer adds, where waste is, and how to slim images before they ship.
Beyond scanning
Findings are step one. Patching, SLAs, and compliance evidence finish the job.
Automatic patching
Buildah and Copa rebuild vulnerable base images with patched packages, preserving your Dockerfile layers. Patched images are signed and re-scanned automatically.
SLA tracking
Per-severity remediation deadlines. Notifications fire on warning thresholds (24h before breach) and breach events. Backfill applies new SLA targets to existing open vulns.
Compliance evidence
SOC 2, PCI-DSS, NIST 800-53, ISO 27001, FedRAMP, HIPAA, CMMC, CIS Docker. Reports are generated on demand from continuously collected evidence.