Open Source Services & Tools
Services
CSAF Provider Online Check
A website which provides easy access to the CSAF Provider Checker.
CSAF Provider Index
A website listing known CSAF Providers and Publishers. Users can submit new entries to the index.
Sec-O-Simple
A website guiding you through the creation of CSAF documents. Allows editing of existing documents as well.
Tools
CSAF Provider
An implementation of the role CSAF Trusted Provider, also offering a simple HTTPS based management service.
CSAF Checker
A tool for testing a CSAF Trusted Provider according to Section 7 of the CSAF standard.
CSAF Validator Library
A JavaScript library is intended to include logic that can be shared across application working with CSAF.
CSAF Validator Service
A service to validate documents against the CSAF standard. It uses the csaf-validator-lib “under-the-hood”.
BSI Secvisogram CSAF Backend CMS
The CSAF Content Management System (CMS) Secvisogram backend code and documentation
CSAF Walker
A Rust library and command line tool for consuming and analyzing CSAF documents.
Clouditor
Clouditor is a tool for the continuous assurance of cloud and other backend services. It supports the conformance check of CSAF (trusted) providers as part of vulnerability management controls.
SecObserve
An open source vulnerability management system that can produce and consume CSAF VEX documents.
Trustify
A collection of software that allow you to store bill of materials (SBOM), vulnerability information (VEX) for your organization and use that information to learn impact of vulnerabilities and dependency changes.
CSAF Perl Tookit
A Perl distribution (with modules and command-line tools) for create, validate, convert (in HTML), publish and download CSAF documents.
kotlin-csaf
A Kotlin implementation of the CSAF standard for the JVM. It supports parsing and validation of CSAF 2.0 documents.
csaf-rust
A Rust implementation of the CSAF standard. It supports parsing (and partial validation) of CSAF 2.0 and CSAF 2.1 (Draft) documents.
DependencyTrack CSAF Integration
An integration for the popular dependency management system DependencyTrack.