FossID Workbench vs Twira Dependency Vulnerabilities

FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.

Twira Dependency Vulnerabilities scans software lockfiles for known vulnerabilities and filters findings based on whether packages are installed and imported by code. It checks npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager lockfiles against OSV data, which aggregates GHSA, RustSec, PYSEC, the Go vulnerability database, and other feeds. Findings are available as structured JSON or SARIF 2.1.0. After an initial sync, a local vulnerability-data cache with a 24-hour time-to-live supports offline and air-gapped scans. Accepted-risk suppressions persist through lockfile changes, and detections are recorded in an append-only Merkle audit chain. The same binary can run on a laptop, CI runner, or in an air-gapped environment. Twira says indexing runs locally and indexed content is not telemetered; LLM calls use the customer’s chosen provider and key. The free plan does not list SCA. Pro costs $29.99 a month and includes a free 14-day trial. Twira says the scanner covers application dependencies and known vulnerabilities, not novel malware or several other attack types.