pip-audit Integration with DefectDojo
pip-audit is an open-source Python dependency security scanner developed by Trail of Bits with Google support that audits Python environments, requirements files, and project dependencies for known security vulnerabilities by cross-referencing installed packages against the Python Packaging Advisory Database and Open Source Vulnerabilities (OSV) database via PyPI's JSON API. The tool integrates seamlessly into CI/CD pipelines with support for multiple output formats including JSON and SARIF, provides automated vulnerability remediation with the --fix flag to upgrade vulnerable packages to secure versions, and enables comprehensive dependency security management throughout the software development lifecycle without requiring paid subscriptions or licensing.
Data Granularity: What Gets Imported
The following fields are captured from pip-audit results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "pip-audit",
"engagement": "<engagement-id>",
"file": "results.json"
}