Vulnerability Auditor

GitHub Vulnerability Auditor is a command-line tool to audit your GitHub repositories for GitHub Security Advisories ( GHSA). It takes in a list of GitHub Security Advisories and a time threshold in months and returns a CSV and JSON file containing all of your repositories affected by the list of GHSA's you provided, as well as the last time the repository received a commit to its default branch and whether the last commit is older than the time threshold you provided.

Download the latest binaries from this link: https://github.com/lindluni/warden-vulnerability-auditor/releases

Example Usage:

Usage: vulnerability-auditor [options]

Options:
  -V, --version             output the version number
  -t, --token <string>      GitHub personal access token
  -o, --org <string>        GitHub organization
  -h, --threshold <number>  Months since last commit
  -i, --ids <items>         Comma-separated list of GHSA IDs
  -u, --url <string>        GitHub Enterprise URL
  --help                    display help for command

vulnerability-auditor -t fake-token -o fake-org -h 12 -i GHSA-1234,GHSA-5678

You may set the --url flag to use GitHub Enterprise instead of GitHub.com.

Will retrieve all repositories in the fake-org organization that contain the vulnerabilities GHSA-1234 and GHSA-5678 and will flag those repos that have NOT been updated in the last 12 months.

NOTE: You may retrieve the GHSA IDs from the GitHub Security Advisory page By selecting the vulnerability and copy-pasting the GHSA ID from the URL.