Introducing ojo: ColibriSec's Open Source Security Scanner
Introducing ojo: a single static binary for vulnerability scanning, secret detection, SAST, and IaC misconfiguration checks with zero external dependencies.
We are excited to open source ojo, an all-in-one security scanner engineered by ColibriSec for modern engineering teams. It detects known vulnerabilities across dependencies, container images, source code, and Infrastructure-as-Code (IaC)—all packaged inside a single, zero-dependency static binary.
apk and dpkg layers without a Docker daemon.
Documentation & Releases: Live at colibrisec.dev.
Quickstart in 10 Seconds
Install the binary and run your first scan against any local project repository:
# Install via official installer script
curl -sSfL https://colibrisec.dev/install.sh | sh
# Scan current filesystem (dependencies, secrets, IaC, SAST)
ojo fs .
# Scan a container image directly (no Docker daemon needed)
ojo image alpine:latest
What ojo Scans
ojo provides two streamlined entry points:
ojo fs <path>: Scans local filesystems and Git repositories. Parses manifests across 10 ecosystems (npm, Go modules, PyPI, Cargo, Maven, Composer, NuGet, Bundler, Hex), identifies hardcoded API keys and secrets via regex heuristics, validates Dockerfile/Kubernetes/Terraform configs, and executes AST-based SAST.ojo image <image:tag>: Pulls container images using the OCI registry protocol and diffs installed OS packages against vulnerability databases.
Why We Built It
Modern security pipelines are fragmented across a dozen separate CLI tools—one for SBOMs, one for secrets, one for Docker, one for SAST. This creates massive CI/CD bloat, conflicting exit codes, and high maintenance overhead.
We built ojo to provide a unified, blazingly fast scanner that runs locally on developer laptops and seamlessly integrates into CI/CD pipelines in milliseconds.
