Install vet with Homebrew

Project links

• Homepage
• Repository

Commands and aliases

• vet

Project history

The public repository was created on December 30, 2022, with early development releases appearing in January 2023. The project grew around the post-SolarWinds and post-typosquatting supply-chain-security problem: application teams needed automated dependency review that could be enforced locally and in CI rather than handled as a manual checklist.

SafeDep documentation describes Vet as a free, open-source SCA scanner for malicious, vulnerable, and risky dependencies in code and CI/CD. Its policy approach uses CEL expressions and policy suites, tying it to the broader policy-as-code movement rather than only to fixed vulnerability reports.

Adoption history

Vet's adoption path is integration-driven. The project documents use in local scans, arbitrary CI systems, and a native GitHub Action for policy-driven guardrails. Its README also lists multi-ecosystem support across common package managers, container images, SBOM formats, and source repositories, which makes it useful as a cross-language dependency gate.

As SafeDep expanded, Vet became the CLI engine for a larger supply-chain-security platform. Official materials connect the CLI to OSV, OpenSSF Scorecard, deps.dev, SafeDep malware intelligence, active malware analysis, SARIF/JSON/CSV reporting, and SafeDep Cloud.

How it is used

Typical use starts with `vet scan -D /path/to/dir` to auto-discover known dependency manifests in a repository. Users can also scan a single manifest, a package URL, a Java archive, an OCI image, or an SBOM, then apply CEL filters or filter suites to fail a build when packages violate organization policy.

The tool is especially useful when teams want dependency governance to be versioned with the code. A repository can carry a YAML policy file that blocks critical vulnerabilities, disallowed licenses, low-maintenance projects, known malware indicators, or other package metadata conditions.

Why package nerds care

Vet sits in the package-nerd sweet spot where registry metadata, vulnerability feeds, maintainer health, malware signals, and CI enforcement all meet. It is less about one ecosystem's lockfile and more about making open-source dependency choice auditable across ecosystems.

Timeline

• 2022-12-30: GitHub repository created.
• 2023-01-12: Early v0.0.1-dev release published.
• 2026-06-24: GitHub page lists v1.17.5 as the latest release.
• 2020s: SafeDep documentation positions Vet as a policy-as-code SCA scanner integrated with CI/CD and supply-chain intelligence sources.

Related projects

• SafeDep Cloud: hosted intelligence and policy services used with Vet.
• vet-action: the GitHub Action integration for running Vet in CI.
• OSV, OpenSSF Scorecard, deps.dev, Syft, and SLSA: ecosystem data and standards referenced by the project documentation and README.

Sources

• https://api.github.com/repos/safedep/vet
• https://api.github.com/repos/safedep/vet/releases?per_page=100
• https://docs.safedep.io/vet/advanced/policy-as-code
• https://docs.safedep.io/vet/concepts/why-vet
• https://docs.safedep.io/vet/quickstart
• https://github.com/safedep/vet