> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/osv-scanner-reference.md).

# Open Source Vulnerabilities (OSV) step configuration

You can scan your code repositories using [Open Source Vulnerabilities (OSV)](https://google.github.io/osv-scanner/) and ingest your results into Harness STO. OSV supports a [variety of languages and lockfiles](https://google.github.io/osv-scanner/supported-languages-and-lockfiles).

### Important notes for running OSV scans in STO <a href="#important-notes-for-running-osv-scans-in-sto" id="important-notes-for-running-osv-scans-in-sto"></a>

#### Root access requirements <a href="#root-access-requirements" id="root-access-requirements"></a>

#### For more information <a href="#for-more-information" id="for-more-information"></a>

### OSV step settings for STO scans <a href="#osv-step-settings-for-sto-scans" id="osv-step-settings-for-sto-scans"></a>

The recommended workflow is to add an OSV step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

**Variant**

#### Ingestion <a href="#ingestion" id="ingestion"></a>

**Ingestion File**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [`osv`](https://google.github.io/osv-scanner/usage/) scanner with flags such as:

`--lockfile=/path/to/your/package-lock.json --lockfile=/path/to/another/Cargo.lock`

With these flags, the `osv` scanner scans vulnerabilities in the two specified lockfiles.

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Configure OSV as a Built-in Scanner <a href="#configure-osv-as-a-built-in-scanner" id="configure-osv-as-a-built-in-scanner"></a>

The OSV scanner is available as a [built-in scanner](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/built-in-scanners.md) in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for **SCA** in the step palette or navigate to the **Built-in Scanners** section and select the **SCA** step.
2. Select **OSV** from the list of scanners.
3. Expand the **Additional CLI Flags** section if you want to configure optional CLI flags.
4. Click **Add Scanner** to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### YAML pipeline example <a href="#yaml-pipeline-example" id="yaml-pipeline-example"></a>

If you copy and paste the following example, make sure you update the placeholders for your project, Git connector, and build infrastructure.

```yaml
pipeline:
  projectIdentifier: YOUR_HARNESS_PROJECT
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: YOUR_GITHUB_CONNECTOR
        repoName: <+stage.variables.GITHUB_REPO>
        build: <+input>
  stages:
    - stage:
        name: osv_scan
        identifier: osv_scan
        type: SecurityTests
        spec:
          cloneCodebase: true
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: YOUR_KUBERNETES_CLUSTER_CONNECTOR_ID
              namespace: YOUR_NAMESPACE
              automountServiceAccountToken: true
              nodeSelector: {}
              os: Linux
          sharedPaths:
            - /var/run
          execution:
            steps:
              - step:
                  type: OsvScanner
                  name: OsvScanner_1
                  identifier: OsvScanner_1
                  spec:
                    mode: orchestration
                    config: default
                    target:
                      type: repository
                      detection: manual
                      name: <+stage.variables.GITHUB_REPO>
                      variant: <+stage.variables.GITHUB_BRANCH>
                    advanced:
                      log:
                        level: info
                      fail_on_severity: medium
          slsa_provenance:
            enabled: false
          caching:
            enabled: false
            paths: []
        variables:
          - name: GITHUB_REPO
            type: String
            description: ""
            required: false
            value: <+input>
          - name: GITHUB_BRANCH
            type: String
            description: ""
            required: false
            value: <+input>
        when:
          pipelineStatus: Success
        description: ""
  identifier: osvnodegoat
  name: osv-nodegoat


```