Open-source enterprise SCA portal — manage CVEs, license compliance, and SBOMs in one self-hosted UI.
TRUSCA (short for Trusted SCA) is an Apache-2.0 licensed, self-hosted alternative to commercial Software Composition Analysis (SCA) products. It unifies vulnerability tracking (CVE), license compliance, and Software Bill of Materials (SBOM) management for engineering and legal teams.
🔭 Live demo: trusca-demo.duckdns.org — a public, read-only demo seeded with real projects, scans, CVEs, licenses, and SBOMs. Sign in as [email protected] / DemoTest2026! (the same password works for every seeded account). Writes are disabled and the dataset resets nightly; you can also upload a CycloneDX SBOM to the Demo Sandbox project and watch it matched against licenses and CVEs. See Live demo.
Why TRUSCA
- Self-hosted, no vendor lock-in. Apache-2.0, deployable via
docker-compose or Helm. No per-seat licensing.
- Unified risk view. CVEs, licenses, and SBOM in one project page — no context switching.
- CI/CD native. REST API + GitHub/GitLab webhooks + build-blocking gate (Critical CVE / forbidden license → exit 1).
- Enterprise-grade workflows. Component approval, license obligations + auto-NOTICE generation, append-only audit log, RBAC.
- Internationalized from day one. English and Korean UI — and this documentation — shipped together.
Scan engine
TRUSCA scans with its own pipeline by default (build-prep, cdxgen, scancode, Trivy). It can also run BomLens as the scan engine (preview, SCAN_ENGINE=bomlens for source scans and SCAN_CONTAINER_ENGINE=bomlens for container scans). BomLens is an open source SBOM generator and open-source risk assessor from SK Telecom's open source program office. It runs on a single machine and produces CycloneDX SBOMs, notices and security reports; TRUSCA adds what a whole organization needs on top of them: a project inventory, vulnerability triage, and license policy gates. See the administrator guide, "Dynamic scan executor", for how to turn it on.
Project list — risk roll-up across every scanned project.
Vulnerability list — CVEs from Trivy's unified DB (NVD + OSV + GHSA + EPSS + KEV) with a 7-state VEX triage workflow.
SBOM tab — CycloneDX and SPDX export in JSON, XML, and Tag-Value.
Admin System Health — service status, scan queue, disk, and Trivy DB freshness at a glance.
Feature highlights
- Component detection across 30+ language ecosystems (cdxgen, CycloneDX generator), with direct vs. transitive dependency-graph depth
- Dynamic per-environment scanning (opt-in, on-prem) —
SCAN_EXECUTOR=local_docker launches a per-environment cdxgen sidecar for toolchains the worker does not carry; closes the Android gap (no SDK in the worker → 0 components) by routing to the Android SDK image. See the admin guide
- License classification with allowed / conditional / forbidden tiers, scored against a fixed classification catalog (dynamic per-team policy editing is on the roadmap)
- Vulnerability detection via Trivy's unified DB (NVD + OSV + GitHub Advisory + EPSS + KEV) with weekly DB refresh, automatic re-detection of new CVEs, 7-state VEX triage, EPSS prioritization (column / sort / filter / policy-gate threshold), and per-finding
fixed_version
- Container image scanning for OS-package CVEs (Trivy)
- SBOM export — CycloneDX (JSON/XML) + SPDX (JSON/Tag-Value), byte-stable; VEX export and VEX consumption (import OpenVEX / CycloneDX VEX to auto-suppress findings)
- SBOM ingest — upload a CycloneDX or SPDX SBOM your own tooling produced (
POST /v1/projects/{id}/sbom-ingest); TRUSCA scores its conformance (pass/warn/fail, advisory) and matches CVEs without cloning or building your source
- Vulnerability report as PDF (
GET /v1/projects/{id}/vulnerability-report.pdf); Excel and compliance-PDF reports are on the roadmap
- Obligations tracking + auto-generated
NOTICE files (text / markdown / HTML)
- Component approval workflow (Pending → Under Review → Approved / Rejected)
- Notifications: Email (SMTP), Slack, Microsoft Teams
- Admin: user/team management, Trivy DB monitoring + weekly refresh, scan queue, disk dashboard, audit log
- CI integrations: GitHub Action, GitLab CI template, Jenkinsfile example (Jenkins has no native plugin — the Jenkinsfile is a worked example)
- Hosted OpenAPI reference on the docs site, a
/health/ready schema-gated readiness probe, a read-only live-demo mode, and a production-grade Helm chart
Tech stack
| Layer | Technology |
|---|
| Backend | FastAPI · SQLAlchemy 2.0 · Alembic |
| Database | PostgreSQL 17 |
| Async | Celery + Redis |
| Frontend | React 18 · Vite · shadcn/ui · Tailwind CSS |
| Server state | TanStack Query |
| Client state | Zustand |
| Realtime | WebSocket (scan progress streaming) |
| Auth | FastAPI-Users (JWT + OAuth2) |
| i18n | react-i18next |
| Tests | pytest · Playwright (harness pattern) |
| Docs | Docusaurus |
| CI/CD | GitHub Actions |
| Containers | Docker Compose (dev/prod split), Helm chart |
Quick start (development)
git clone https://github.com/trustedoss/trusca.git
cd trusca
cp .env.example .env
docker-compose -f docker-compose.dev.yml up
# → http://localhost:5173 (frontend) · http://localhost:8000/docs (API)
After roughly 30 seconds the dev containers (postgres, redis, backend, celery-worker, frontend) are healthy.
Other ways to run it
- Production (Docker Compose) — use the bundled
docker-compose.yml (Traefik + Let's Encrypt). See the installation guide.
- Production (Kubernetes / Helm) — the production-grade chart (
charts/trustedoss) ships bundled-or-external PostgreSQL & Redis, an Ingress with cert-manager TLS, and a migration Job. See the Helm / Kubernetes guide.
- Read-only live demo — try the hosted instance at trusca-demo.duckdns.org (
[email protected] / DemoTest2026!), or run your own with DEMO_READ_ONLY=true. See Live demo.
- API reference — the hosted OpenAPI reference is at
/reference/api.
Repository layout
trusca/
├── apps/
│ ├── backend/ FastAPI app (api, core, models, services, tasks, integrations)
│ └── frontend/ React + Vite + shadcn/ui app
├── charts/trustedoss/ Helm chart
├── docs-site/ Docusaurus documentation site (EN/KO)
├── actions/scan/ GitHub Actions composite action — trigger + gate a CI build
├── scripts/ install / upgrade / backup / restore
└── .github/ workflows, issue templates, PR template, CODEOWNERS
Documentation
For contributors
Contributing
Contributions are welcome — code, documentation, translations, bug reports, and design feedback. Start with CONTRIBUTING.md for local setup and the PR process, and SUPPORT.md if you have a question first. All participants are expected to follow the Code of Conduct.
SCA self-scan
The portal dog-foods its own toolchain. A nightly GitHub Actions workflow (.github/workflows/sca-self.yml) generates a CycloneDX SBOM with cdxgen, runs Trivy against it, and auto-opens / closes a labelled GitHub issue when Critical CVEs appear in our dependency tree.
Security
Please do not open a public issue for an unpatched vulnerability. See SECURITY.md for the private disclosure process.
License
Apache License 2.0 — see LICENSE and NOTICE.
