services

May 19, 2026

Changes in this version

type ConfigService

+ func (service ConfigService) GetInstanceSettings(ctx context.Context) (shared.InstanceSettings, error)

+ type CrowdsourcedVexingService struct

+ func NewCrowdsourcedVexingService(vexRuleRepository shared.VEXRuleRepository, ...) *CrowdsourcedVexingService

+ func (s *CrowdsourcedVexingService) Recommend(ctx shared.Context, tx shared.DB, vulnID uuid.UUID) (models.VEXRule, error)

Apr 27, 2026

Changes in this version

+ func NewDependencyProxyService(dependencyProxySecretRepository shared.DependencyProxySecretRepository) *dependencyProxySecretService

type DependencyVulnService

+ func (s *DependencyVulnService) UserReopenedToOpen(ctx context.Context, tx shared.DB, userID string, ...) error

Apr 8, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Mar 30, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Changes in this version

+ func GenerateDocumentTitle(assetName, cveID string) *string

type ArtifactService

+ func (s *ArtifactService) GatherVexInformationIncludingResolvedMarking(ctx context.Context, assetVersion models.AssetVersion, artifactName *string) ([]models.DependencyVuln, error)

type DependencyVulnService

+ func (s *DependencyVulnService) GetAllUniqueCVEsForAsset(ctx context.Context, assetID uuid.UUID, ...) ([]models.DependencyVuln, error)

Mar 23, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Mar 16, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Mar 2, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Changes in this version

type ComponentService

+ func (s *ComponentService) FetchComponentProject(component models.Component) (models.Component, error)

Feb 20, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Changes in this version

+ var ServiceModule = fx.Options(fx.Provide(fx.Annotate(utils.NewFireAndForgetSynchronizer, ...)), ...)

+ func CreateYAMLMetadata(organizationName string, assetName string, assetVersionName string) dtos.YamlMetadata

+ func FetchMembersOfAsset(ctx shared.Context) ([]dtos.UserDTO, error)

+ func GenerateCSAFReport(ctx shared.Context, dependencyVulnRepository shared.DependencyVulnRepository, ...) (gocsaf.Advisory, error)

+ func HexPubKeyToECDSA(hexPubKey string) ecdsa.PublicKey

+ func HexTokenToECDSA(hexToken string) (ecdsa.PrivateKey, ecdsa.PublicKey, error)

+ func MarkdownTableFromSBOM(outputFile *bytes.Buffer, bom *cdx.BOM) error

+ func NewAssetService(assetRepository shared.AssetRepository, ...) *assetService

+ func NewAssetVersionService(assetVersionRepository shared.AssetVersionRepository, ...) *assetVersionService

+ func NewCSAFService(client http.Client) *csafService

+ func NewDatabaseLeaderElector(configService shared.ConfigService) *databaseLeaderElector

+ func NewExternalEntityProviderService(projectService shared.ProjectService, assetService shared.AssetService, ...) externalEntityProviderService

+ func NewFirstPartyVulnService(firstPartyVulnRepository shared.FirstPartyVulnRepository, ...) *firstPartyVulnService

+ func NewOpenSourceInsightService() *openSourceInsightService

+ func NewProjectService(projectRepository shared.ProjectRepository, ...) *projectService

+ func NewReleaseService(releaseRepository shared.ReleaseRepository) *releaseService

+ func NewScanService(db shared.DB, cveRepository shared.CveRepository, ...) *scanService

+ func NewStatisticsService(statisticsRepository shared.StatisticsRepository, ...) *statisticsService

+ func NewWebhookService(url string, secret *string) *webhookClient

+ func SignCSAFReport(csafJSON []byte) ([]byte, error)

+ func SignRequest(hexPrivKey string, req *http.Request) error

+ type ArtifactService struct

+ func NewArtifactService(artifactRepository shared.ArtifactRepository, csafService shared.CSAFService, ...) *ArtifactService

+ func (s *ArtifactService) DeleteArtifact(assetID uuid.UUID, assetVersionName string, artifactName string) error

+ func (s *ArtifactService) GetArtifactsByAssetIDAndAssetVersionName(assetID uuid.UUID, assetVersionName string) ([]models.Artifact, error)

+ func (s *ArtifactService) ReadArtifact(name string, assetVersionName string, assetID uuid.UUID) (models.Artifact, error)

+ func (s *ArtifactService) SaveArtifact(artifact *models.Artifact) error

+ type ComponentService struct

+ func NewComponentService(openSourceInsightsService shared.OpenSourceInsightService, ...) *ComponentService

+ func (s *ComponentService) FetchInformationSources(artifact *models.Artifact) ([]models.ComponentDependency, error)

+ func (s *ComponentService) GetAndSaveLicenseInformation(tx shared.DB, assetVersion models.AssetVersion, artifactName *string, ...) ([]models.Component, error)

+ func (s *ComponentService) GetLicense(component models.Component) (models.Component, error)

+ func (s *ComponentService) RefreshComponentProjectInformation(project models.ComponentProject)

+ func (s *ComponentService) RemoveInformationSources(artifact *models.Artifact, rootNodePurls []string) error

+ type ConfigService struct

+ func NewConfigService(db shared.DB) ConfigService

+ func (service ConfigService) GetJSONConfig(key string, v any) error

+ func (service ConfigService) RemoveConfig(key string) error

+ func (service ConfigService) SetJSONConfig(key string, v any) error

+ type DependencyVulnService struct

+ func NewDependencyVulnService(dependencyVulnRepository shared.DependencyVulnRepository, ...) *DependencyVulnService

+ func (s *DependencyVulnService) CreateVulnEventAndApply(tx shared.DB, assetID uuid.UUID, userID string, ...) (models.VulnEvent, error)

+ func (s *DependencyVulnService) RecalculateRawRiskAssessment(tx shared.DB, userID string, dependencyVulns []models.DependencyVuln, ...) ([]models.DependencyVuln, error)

+ func (s *DependencyVulnService) SyncAllIssues(org models.Org, project models.Project, asset models.Asset, ...) error

+ func (s *DependencyVulnService) SyncIssues(org models.Org, project models.Project, asset models.Asset, ...) error

+ func (s *DependencyVulnService) UserDetectedDependencyVulnInAnotherArtifact(tx shared.DB, vulnerabilities []models.DependencyVuln, scannerID string) error

+ func (s *DependencyVulnService) UserDetectedDependencyVulns(tx shared.DB, artifactName string, dependencyVulns []models.DependencyVuln, ...) error

+ func (s *DependencyVulnService) UserDetectedExistingVulnOnDifferentBranch(tx shared.DB, scannerID string, ...) error

+ func (s *DependencyVulnService) UserDidNotDetectDependencyVulnInArtifactAnymore(tx shared.DB, vulnerabilities []models.DependencyVuln, scannerID string) error

+ func (s *DependencyVulnService) UserFixedDependencyVulns(tx shared.DB, userID string, dependencyVulns []models.DependencyVuln, ...) error

+ type InTotoService struct

+ func NewInTotoService(rbacProvider shared.RBACProvider, ...) *InTotoService

+ func (service InTotoService) HexPublicKeyToInTotoKey(hexPubKey string) (toto.Key, error)

+ func (service InTotoService) VerifySupplyChain(supplyChainID string) (bool, error)

+ func (service InTotoService) VerifySupplyChainByDigestOnly(digest string) (bool, error)

+ func (service InTotoService) VerifySupplyChainWithOutputDigest(imageNameOrSupplyChainID string, digest string) (bool, error)

+ type LicenseRiskService struct

+ func NewLicenseRiskService(licenseRiskRepository shared.LicenseRiskRepository, ...) *LicenseRiskService

+ func (s *LicenseRiskService) FindLicenseRisksInComponents(assetVersion models.AssetVersion, components []models.Component, ...) error

+ func (s *LicenseRiskService) MakeFinalLicenseDecision(vulnID, finalLicense, justification, userID string) error

+ func (s *LicenseRiskService) UpdateLicenseRiskState(tx shared.DB, userID string, licenseRisk *models.LicenseRisk, ...) (models.VulnEvent, error)

+ func (s *LicenseRiskService) UserDetectedExistingLicenseRiskOnDifferentBranch(tx shared.DB, artifactName string, licenseRisks []models.LicenseRisk, ...) error

+ func (s *LicenseRiskService) UserDetectedLicenseRiskInAnotherArtifact(tx shared.DB, licenseRisks []models.LicenseRisk, artifactName string) error

+ func (s *LicenseRiskService) UserDetectedLicenseRisks(tx shared.DB, assetID uuid.UUID, assetVersionName, artifactName string, ...) error

+ func (s *LicenseRiskService) UserDidNotDetectLicenseRiskInArtifactAnymore(tx shared.DB, licenseRisks []models.LicenseRisk, artifactName string) error

+ func (s *LicenseRiskService) UserFixedLicenseRisks(tx shared.DB, userID string, licenseRisks []models.LicenseRisk) error

+ func (s *LicenseRiskService) UserFixedLicenseRisksByAutomaticRefresh(tx shared.DB, userID string, licenseRisks []licenseRiskWithNewLicense, ...) error

+ type OrgService struct

+ func NewOrgService(organizationRepository shared.OrganizationRepository, ...) *OrgService

+ func (o *OrgService) CreateOrganization(ctx shared.Context, organization *models.Org) error

+ func (o *OrgService) ReadBySlug(slug string) (*models.Org, error)

+ type PatService struct

+ func NewPatService(repository shared.PersonalAccessTokenRepository) *PatService

+ func (p *PatService) RevokeByPrivateKey(privKey string) error

+ func (p *PatService) ToModel(request dtos.PatCreateRequest, userID string) models.PAT

+ func (p *PatService) VerifyRequestSignature(req *http.Request) (string, string, error)

+ type TestPayloadType string

+ const TestPayloadTypeEmpty

+ const TestPayloadTypeSampleDependencyVulns

+ const TestPayloadTypeSampleFirstPartyVulns

+ const TestPayloadTypeSampleSBOM

+ type VEXRuleService struct

+ func NewVEXRuleService(vexRuleRepository shared.VEXRuleRepository, ...) *VEXRuleService

+ func (s *VEXRuleService) ApplyRulesToExisting(tx shared.DB, rules []models.VEXRule, vulns []models.DependencyVuln) ([]models.DependencyVuln, error)

+ func (s *VEXRuleService) ApplyRulesToExistingForce(tx shared.DB, rules []models.VEXRule, vulns []models.DependencyVuln) ([]models.DependencyVuln, error)

+ func (s *VEXRuleService) ApplyRulesToExistingVulns(tx shared.DB, rules []models.VEXRule) ([]models.DependencyVuln, error)

+ func (s *VEXRuleService) ApplyRulesToExistingVulnsForce(tx shared.DB, rules []models.VEXRule) ([]models.DependencyVuln, error)

+ func (s *VEXRuleService) Begin() shared.DB

+ func (s *VEXRuleService) CountMatchingVulns(tx shared.DB, rule models.VEXRule) (int, error)

+ func (s *VEXRuleService) CountMatchingVulnsForRules(tx shared.DB, rules []models.VEXRule) (map[string]int, error)

+ func (s *VEXRuleService) Create(tx shared.DB, rule *models.VEXRule) error

+ func (s *VEXRuleService) Delete(tx shared.DB, rule models.VEXRule) error

+ func (s *VEXRuleService) DeleteByAssetVersion(tx shared.DB, assetID uuid.UUID, assetVersionName string) error

+ func (s *VEXRuleService) FindByAssetVersion(tx shared.DB, assetID uuid.UUID, assetVersionName string) ([]models.VEXRule, error)

+ func (s *VEXRuleService) FindByAssetVersionAndCVE(tx shared.DB, assetID uuid.UUID, assetVersionName string, cveID string) ([]models.VEXRule, error)

+ func (s *VEXRuleService) FindByAssetVersionAndVulnID(tx shared.DB, assetID uuid.UUID, assetVersionName string, vulnID string) ([]models.VEXRule, error)

+ func (s *VEXRuleService) FindByAssetVersionPaged(tx shared.DB, assetID uuid.UUID, assetVersionName string, ...) (shared.Paged[models.VEXRule], error)

+ func (s *VEXRuleService) FindByID(tx shared.DB, id string) (models.VEXRule, error)

+ func (s *VEXRuleService) IngestVEX(tx shared.DB, asset models.Asset, assetVersion models.AssetVersion, ...) error

+ func (s *VEXRuleService) IngestVexes(tx shared.DB, asset models.Asset, assetVersion models.AssetVersion, ...) error

+ func (s *VEXRuleService) Update(tx shared.DB, rule *models.VEXRule) error

+ type WebhookStruct struct

+ Artifact shared.ArtifactObject

+ Asset shared.AssetObject

+ AssetVersion shared.AssetVersionObject

+ Organization shared.OrgObject

+ Payload any

+ Project shared.ProjectObject

+ Type WebhookType

+ type WebhookType string

+ const WebhookTypeDependencyVulnerabilities

+ const WebhookTypeFirstPartyVulnerabilities

+ const WebhookTypeSBOM

+ const WebhookTypeTest

Feb 17, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Jan 19, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Jan 13, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Jan 8, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Jan 4, 2026 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 30, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 23, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 19, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 15, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 14, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 14, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 14, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 12, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 9, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 4, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Dec 4, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Nov 24, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard

Nov 20, 2025 GO-2026-4988

  GO-2026-4988: DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header in github.com/l3montree-dev/devguard