Policy-driven auditing for your SBOMs
FlakeAudit is a Rust CLI that evaluates CycloneDX SBOMs against custom policies and reports every violation. It scans components for known vulnerabilities, compares two SBOMs across a range of methods, and exits non-zero when a rule is denied, so you can gate a release on your own policy and track your supply chain as it changes.
Policy-driven SBOM evaluation
Evaluate an SBOM against a versionedflakeaudit.toml policy and get a clear report of every violation. Every rule resolves to allow, warn, or deny, and a denial exits non-zero so your CI run fails.Vulnerability scanning
Query the National Vulnerability Database (NVD) and osv.dev for vulnerabilities affecting your components, then write the results back into the SBOM as CycloneDXvulnerabilities.Pairs with FlakeBOM
Especially useful with FlakeBOM-generated SBOMs, so you can audit and compare the exact CycloneDX output your Nix flakes produce.VEX-aware vulnerability policy
Set a severity floor and map each CycloneDX Vulnerability Exploitability eXchange (VEX) state to an action, so a newly discovered vulnerability blocks a release while the ones your team has already triaged don't.License policy with SPDX expressions
Allow or deny licenses by Software Package Data Exchange (SPDX) identifier or full SPDX expression, and treat unlicensed, unknown, and unmatched components as separate outcomes with their own actions.Nix-aware SBOM comparison
Diff two SBOMs or report coverage against a baseline, matching components byderiver or callstack for the Nix metadata FlakeBOM emits, or by bom-ref, cpe, purl, or name-version for any other SBOM.Component bans and source allowlists
Ban components byname, version, purl, or cpe with glob patterns, add per-component exceptions, restrict which PURL types you consume, and catch components that appear at more than one version.A single static binary
Ships as one statically linked Rust binary foraarch64-darwin, aarch64-linux, and x86_64-linux, with no backend to stand up and no server to keep on a supported version.Complements Secure Packages
Available to Determinate Secure Packages customers, and built to read the curated VEX metadata that ships with the package set.Available with Determinate Secure Packages
FlakeAudit is available exclusively to Determinate Secure Packages customers, the curated, auditable package set it's built to work with.
- FlakeAudit documentation
FlakeAudit documentation (opens in a new tab)
The full FlakeAudit guide, including the policy reference and the component matcher syntax.
- Introducing FlakeAudit
Introducing FlakeAudit
The announcement post, with a walkthrough of policy-driven auditing and Nix-aware SBOM diffing.
- FlakeBOM
FlakeBOM
The companion CLI that generates the CycloneDX SBOMs FlakeAudit audits.
- Determinate Secure Packages
Determinate Secure Packages
Secure, signed, auditable Nix packages, with the curated VEX metadata FlakeAudit reads.
Explore more CLI tools
- Learn more about fhLearn more
fh
The official CLI companion for FlakeHub.
- Learn more about FlakeBOMLearn more
FlakeBOM
Generate spec-compliant SBOMs from any Nix flake.