The next phase of Continuous Analysis

When we introduced SitRep, our goal was simple: bring Continuous Analysis (CA) to software delivery by tracking vulnerability findings build-by-build across CI pipelines using Grype.

Today, we are thrilled to announce SitRep v2.0 — a major milestone that transforms SitRep into an extensible, multi-scanner platform. Alongside our core Grype vulnerability scanner, v2.0 introduces first-class native support for Grant, bringing automated open source licence compliance, policy evaluation, and historical licence diffing into your workflow.

Why Licence Compliance Matters

Software supply chain risk is broader than just known security vulnerabilities (CVEs). Modern applications pull in hundreds of direct and transitive dependencies, each bound by distinct licensing terms.

Accidental introduction of restrictive copyleft licences (e.g. GPL, AGPL, SSPL) or unlicenced packages into proprietary or client-distributed software can lead to serious legal and commercial exposure. Yet in most organisations, licence auditing remains a manual, painful pre-release scramble.

With Grant integrated into SitRep, licence analysis is automated and continuous. Every CI build evaluates all packages in your SBOM against your licence policy, establishing a transparent and verifiable audit trail.

What's New in Version 2.0

Scanner Support

Native Grant Integration

Direct support for Grant licence evaluation reports. Track allowed, denied, ignored, and unlicenced packages build-by-build.

Compliance Tracking

Licence Diffs & History

Automatic diffing calculates when licence violations are introduced and resolved between revisions.

Configuration

Modular Scanner Toggles

Enable and configure scanners (Grype, Grant, and future tools) per product with dedicated dashboard views.

Security & API

Fine-Grained Scoped PATs

Personal Access Tokens with granular read/write permissions, lifecycle statuses, and revocation control.

Unified Multi-Scanner API

SitRep v2.0 standardises report ingestion under a single, unified endpoint: /api/v1/reports. You can submit vulnerability and licence scans using your product UUID and scoped PAT.

Example CI/CD Ingestion Step
# 1. Generate SBOM with Syft
syft my-app:latest -o cyclonedx-json=sbom.json

# 2. Run Grype vulnerability scan
grype sbom:sbom.json -o json=vuln.json

# 3. Run Grant licence compliance check
grant check sbom.json --config .grant.yaml -o json > licences.json

# 4. Push reports to SitRep API
curl -X POST https://app.sit-rep.co.uk/api/v1/reports \
  -H "Authorization: Bearer $SITREP_PAT" \
  -F "tool=grant" \
  -F "product=$PRODUCT_UUID" \
  -F "revision=$CI_COMMIT_SHA" \
  -F "file=@licences.json"

Upgrading & Getting Started

Version 2.0 is live today. Existing projects continue to track Grype vulnerabilities with full backward compatibility.

To enable Grant licence compliance for your products, navigate to Products in your dashboard, verify Grant is enabled, and integrate the Grant step into your build pipeline.

Continuous Analysis, Complete Visibility

SitRep gives your security, compliance, and engineering teams one unified place to answer both questions:

"Is our build safe from vulnerabilities?" and "Is our software legally compliant?"