Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions devops/audit.rst
Original file line number Diff line number Diff line change
Expand Up @@ -175,3 +175,5 @@ name using the ``-p`` / ``--provider`` argument.
<reference_commands_audit>`.
- Read more in the dedicated `blog post
<https://blog.conan.io/introducing-conan-audit-command/>`_.
- Please check the :ref:`conan audit command reference <security>` for other security
related features.
40 changes: 37 additions & 3 deletions security/audit.rst
Original file line number Diff line number Diff line change
@@ -1,7 +1,41 @@
.. _security_audit:

Scanning dependencies with conan audit
======================================

Scanning dependencies
=====================
A new command, `conan audit`, was added in **Conan 2.14**. It provides a built-in way to
**scan your dependencies for known CVEs**.

``conan audit``
For a step-by-step guide on authentication, usage examples, output formats, and setting up
private providers, see :ref:`Checking package vulnerabilities <devops_audit>`. In short:

1. **Register** at `audit.conan.io <https://audit.conan.io/register>`_
2. **Save your token** and **activate it** via the confirmation email you receive.
3. **Configure Conan to use your token**:

.. code-block:: bash

conan audit provider auth conancenter --token=<token>

4. Run a scan:

.. code-block:: bash

# Check a specific reference
conan audit list zlib/1.2.13

# Scan the entire dependency graph
conan audit scan . # Path to the conanfile.py/txt


This command also supports using your own JFrog Platform as a private provider for
vulnerability scanning. See the :ref:`Adding private providers
<devops_audit_private_providers>` section for more details.

.. seealso::

- For detailed reference documentation on all ``conan audit`` subcommands and their
options, consult the :ref:`conan audit command reference
<reference_commands_audit>`.
- Read more in the dedicated `blog post
<https://blog.conan.io/introducing-conan-audit-command/>`_.