Making vulnerability scans reproducible with dumpscan

Description and use

Dumpscan provides reproducible vulnerability scan results by recording all inputs and enabling exact replay and diffing.

Problem

Vulnerability scan results can change over time due to updated advisories, scanner logic, or exclusions, making it hard to trace the cause of differences during audits or incident reviews.

Outcome

Dumpscan ensures that vulnerability scan results are fully reproducible, verifiable, and explainable by recording all inputs and enabling precise diffing of changes.

Workflow

• Install dumpscan via npm or npx
• Create an OSV snapshot with dumpscan snapshot
• Run a scan with dumpscan scan --snapshot <path> --out <bundle>
• Optionally sign the bundle with --sign
• Verify the bundle with dumpscan verify
• Replay the scan with dumpscan replay to confirm reproducibility
• Diff two bundles with dumpscan diff to identify changed inputs

Evidence

dumpscan is an open-source vulnerability scanner that treats each result as a claim that should be possible to reproduce and verify.

Source

The bundle can then be checked without running another scan: dumpscan verify scan.bundle.json

Source