Introduction

Hibou (French for owl) is an open-source, self-hostable security intelligence platform for the whole software lifecycle. It connects to your Git forges, ingests the findings that today live scattered across a dozen scanners, and merges them into one calm, multi-tenant view of dependency, code, and release risk.

Wisdom over alarm. Signal over noise. Eyes on what you ship.

Alpha

Hibou is in alpha: a solo, spare-time project built with LLM assistance, not a production-readiness or support promise. Expect bugs, incomplete workflows, and documentation that lags behind the code. Hibou is self-hosted only and licensed under AGPL-3.0-only.

Why Hibou?

Most teams watch their supply chain through disconnected tools — SBOMs in one, secrets in another, SARIF somewhere else — with no single view of what’s actually reachable or shippable. Hibou is the owl on the branch above: it watches every dependency, commit, and release, surfaces only what matters, and — because it’s open source and runs as a single binary you host — it answers to you.

What Hibou does

• SBOM & dependencies — Ingest CycloneDX (JSON/XML) and SPDX (JSON) with async processing and dedup; track each component’s risk over time.
• Vulnerability intelligence — Pluggable advisory providers (OSV.dev, NVD, GitHub Advisory, Trivy, Sonatype OSS Index) with canonical alias merging.
• Reachability analysis — Go call-graph (RTA/VTA), Java bytecode, and Rust source analysis to auto-VEX vulnerabilities that can’t actually be reached.
• Secrets & malware — Gitleaks, TruffleHog, betterleaks and the GitHub secret-scanning API; typosquat, dependency-confusion, backdoor and cryptominer detection.
• SARIF & code findings — Ingest from Semgrep, CodeQL, or any SARIF 2.1.0 producer.
• VEX & compliance — OpenVEX, CSAF and CycloneDX VEX with automatic VEX on upgrade/removal, supplier propagation, and ISO 27001 control mapping.
• PR quality gates — Delta analysis of new vs. resolved findings, coverage thresholds, and inline annotations on the forge.
• Release & client tracking — Deployments, rollback history, and CVE impact across clients.

Built for self-hosting

Hibou ships as one Go binary that embeds the Vue 3 SPA — plus a REST API, a CI-friendly CLI, a built-in MCP server for AI assistants, real-time WebSocket updates, an immutable audit log, and a Helm chart for Kubernetes.

Component	Technology
Backend API	Go (Chi router), zerolog, sqlc
Frontend	Vue 3 + TypeScript + Pinia + Tailwind CSS
Database	PostgreSQL 18
Scanner	Trivy (server mode)
Auth	OAuth2 per forge provider
RBAC	Casbin — organizations, teams, roles

The watch

Hibou follows risk across the lifecycle so nothing slips through between tools:

1. Dependency — SBOM ingestion, vulnerability matching, malware detection.
2. Code — SARIF findings, secret scanning, reachability to cut false positives.
3. Pull request — Delta gates, coverage thresholds, inline forge annotations.
4. Release — Deployments, rollback history, CVE impact tracked across clients.

Ready to try it? Head to the Quick Start.