Nancy Integration with DefectDojo

Nancy Integration with DefectDojo

Nancy is an open source dependency checker for Go projects, maintained by the Sonatype Nexus Community on GitHub (the project notes it is not an officially supported Sonatype product). It reads the module list produced by go list and checks each package against Sonatype's vulnerability data, reporting vulnerable modules with their advisories, CVSS scores, and references. Nancy can print results as text, CSV, or JSON, and DefectDojo imports the JSON output.

Nancy Integration with DefectDojo

We run Nancy on our Go services because it is small, fast, and fits into the same pipeline step as go build. DefectDojo is where its output turns into tracked work. Each vulnerable module from a Nancy report becomes a Finding on the Asset that owns the service, with a severity derived from the CVSS score, a component name and version, and a deduplication key that survives the next build. When someone bumps a module to a fixed version, the next reimport closes the finding instead of leaving us to compare two JSON files.

Why Nancy Matters

Go binaries compile their dependencies in, so a vulnerable module ships inside every artifact built from that go.mod. Nancy gives teams a cheap check for that risk.

• It works from go list -json -deps, which reflects the modules the build actually resolves, including transitive ones.
• Results identify the module by its package URL (purl), so you can see exactly which path and version is affected.
• Each advisory carries a CVSS score and often a CVSS vector, which gives a consistent basis for severity.
• On its own, Nancy only answers "is this build vulnerable right now." It has no record of what was open last week, who owns it, or whether anyone accepted the risk.

Advantages of This Integration

What we gained by sending Nancy results through DefectDojo:

• Stable deduplication. Nancy Scan findings are hashed on title and the tool's vulnerability ID, so the same advisory on the same module is recognized across builds instead of piling up.
• Lifecycle on reimport. Reimporting a new report into the same Test mitigates advisories that disappeared after a module upgrade, adds new ones, and reactivates any that come back.
• Severity you can put an SLA on. The parser converts each CVSS score into DefectDojo's Critical through Info scale, so Go dependency findings fall under the same SLA rules as findings from other scanners.
• CVE-level reporting. The CVE from each advisory is stored as a vulnerability ID, so you can search for one CVE across every Go service in DefectDojo.
• Ownership and ticketing. Findings can be assigned, annotated, risk-accepted, or pushed to Jira from the Asset that owns the service.

How This Integration Works

DefectDojo imports Nancy results with the Nancy Scan scan type.

1. Produce a JSON report. From the module root, pipe the dependency list into nancy sleuth and ask for JSON output:

go list -json -deps ./... | nancy sleuth --output json > nancy.json

The parser requires the JSON layout. It reads the vulnerable array from the report and raises an error if that key is missing, so text or CSV output will not import. Current Nancy releases document token-based authentication for Sonatype's vulnerability data, so check the Nancy README for the credentials your CI job should pass.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Nancy Scan, and upload the file. For automation, use the API, which works the same in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Nancy Scan" \
  -F "file=@nancy.json" \
  -F "product_name=billing-service" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import from a pipeline with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Nancy Scan" \
  --report-path "./nancy.json" \
  --product-name "billing-service" \
  --engagement-name "CI" \
  --auto-create-context

3. Reimport on later builds. Send subsequent reports to /api/v2/reimport-scan/ against the same Test so module upgrades show up as mitigated findings and the history stays in one place.

Data Granularity: What Gets Imported

One finding is created per advisory on each vulnerable module. Modules with no advisories are skipped.

Use Cases

In a Go CI pipeline: Every merge to main runs Nancy and reimports the report into a Test for that service. Engineers see only what changed since the last build, and a release gate can query DefectDojo for new High or Critical findings while accepted ones stay out of the way.

Across a fleet of Go services: A platform team with 25 Go repositories imports each into its own Asset. When a widely used module gets a new advisory, a CVE search in DefectDojo shows every service that carries it, which beats opening 25 pipeline logs.

During dependency upgrade sprints: Teams that batch module upgrades can reimport before and after, and the mitigated findings become the record of what the sprint actually fixed.

For audit evidence: Each Go dependency finding keeps its discovery date, SLA status, and closure date, so an auditor can see how long vulnerable modules stayed in production builds.

Operational Tips

• Always pass --output json. The default Nancy output is meant for a terminal and will not parse.
• Expect CWE to be empty on many findings. The parser only fills it when the advisory title begins with CWE-, and Nancy titles often start with the CVE in brackets instead.
• Advisories with no CVSS score arrive as Info. Review those rather than letting a low threshold hide them, since a missing score is not the same as low risk.
• Use one Test per service and reimport into it. A new Test per build works but breaks the open-to-mitigated history.
• Tag imports with the branch or release (for example tags=main,v2.3.0) so you can separate release builds from feature branch noise.
• If a vulnerable module is only used in tooling that never ships, risk-accept it with an expiration date and a note, so it comes back for review.