Side by side
CVE Binary Tool vs lockhawk
Both stand on software composition analysis software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxSelf-hostedWindows
CVE Binary Tool offers broad input, ecosystem, SBOM, VEX, and reporting support at no listed cost. Its self-hosted setup and installation requirements matter when planning deployment.
Visit CVE Binary Tool Free plan APILinuxSelf-hosted
lockhawk offers free, self-hosted dependency vulnerability scanning with offline support, CI integrations, and several report formats. Its stated scope centers on npm-related ecosystems, without SBOM generation or reachability analysis.
Visit lockhawkThe facts
| CVE Binary Tool | lockhawk | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Self-hosted, Windows | API, Linux, Self-hosted |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | github.com | github.com |
| On software composition analysis software | #12 of 65 | #16 of 65 |
CVE Binary Tool: what it does well
- Scans binaries and multiple package-list formats
- Supports 451 binary component checkers
- Generates SPDX and CycloneDX SBOMs
- Creates or uses VEX data
- Provides an official GitHub Action
What to know first
- PDF reports require separately installed ReportLab
- Some extraction methods need system libraries
- Older versions are not supported
- Vulnerability data refreshes once daily by default
lockhawk: what it does well
- Scans npm, Yarn, and pnpm lockfiles
- Supports offline vulnerability data
- Provides multiple report formats
- Includes a GitHub Action
- Free plan has no usage limits
What to know first
- Focused on npm ecosystems
- Additional ecosystems are only a roadmap item
- Does not generate SBOMs
- Does not perform reachability analysis
Alternatives to CVE Binary Tool Alternatives to lockhawk The whole list