selvo

Know what's actually dangerous on your Linux servers.

selvo scans your installed packages, checks every CVE against 8 data sources, filters out what your distro already patched, and ranks the rest by blast radius and exploit probability. Not just a list --- a prioritized action plan.

Live at selvo.dev | Public Report | GitHub Action

Quick Start

Scan your server (60 seconds)

curl -s https://selvo.dev/install.sh | SELVO_API_KEY=sk_xxx bash

Collects your real installed packages, sends to the API for analysis, sets up daily monitoring via cron. Supports dpkg, rpm, pacman, apk.

Get a free API key at selvo.dev.

GitHub Actions

- uses: Cope-Labs/selvo-action@v1
  with:
    api-key: ${{ secrets.SELVO_API_KEY }}

Auto-detects runner packages. Posts results as a PR comment. Fails on CISA KEV or weaponized exploits.

curl

# Scan your actual packages
dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}\n' > packages.txt

curl -X POST https://selvo.dev/api/v1/scan/packages \
  -H "X-API-Key: $SELVO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"packages\": \"$(cat packages.txt)\", \"ecosystem\": \"debian\"}"

Container image scan

curl -X POST https://selvo.dev/api/v1/scan/image \
  -H "X-API-Key: $SELVO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "nginx:1.24"}'

Pipe existing scanner output

# Already running Grype or Trivy? Send the JSON for prioritized results:
curl -X POST https://selvo.dev/api/v1/scan \
  -H "X-API-Key: $SELVO_API_KEY" \
  -d "{\"grype\": \"$(cat grype-results.json)\"}"

What Makes It Different

Distro-aware CVE filtering. If Debian backported a fix into zlib 1.2.11, we don't flag it. We cross-reference the Debian Security Tracker to remove CVEs your distro already patched. Other scanners miss this and massively over-report.

Blast radius scoring. A CVE in a library that 200 packages depend on ranks higher than one in a leaf package. We build real dependency graphs from Debian Packages.gz, Alpine APKINDEX, and Arch repo DBs.

Exploit intelligence. CISA KEV status, public exploit availability, EPSS exploitation probability --- not just CVSS severity.

Your actual packages. We scan what's really installed on your system, not a generic reference list. The dashboard shows "Your system" vs "Reference scan" so you know exactly what you're looking at.

Scoring (0--100)

Packages with no securi

... View full README on GitHub