PHPackages                             infinri/ase - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Logging & Monitoring](/categories/logging)
4. /
5. infinri/ase

ActiveLibrary[Logging & Monitoring](/categories/logging)

infinri/ase
===========

Automated Security Evaluator -- Dependency-Track automation: syncs lockfile SBOMs and a declared-tech inventory, scores findings with CISA KEV + EPSS + CVSS, alerts per-team Slack channels on P0/P1.

v1.0.0(3mo ago)1501MITPHPPHP ^8.4CI passing

Since Apr 25Pushed 1mo agoCompare

[ Source](https://github.com/infinri/A.S.E)[ Packagist](https://packagist.org/packages/infinri/ase)[ RSS](/packages/infinri-ase/feed)WikiDiscussions master Synced 1w ago

READMEChangelog (1)Dependencies (5)Versions (2)Used By (0)

A.S.E -- Automated Security Evaluator
=====================================

[](#ase----automated-security-evaluator)

[![Packagist Version](https://camo.githubusercontent.com/203d0857e00b65ff06389eb222232d5808e0e9d56c2e8f86a917faedc6aacfa6/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f696e66696e72692f6173652e737667)](https://packagist.org/packages/infinri/ase)[![License](https://camo.githubusercontent.com/7013272bd27ece47364536a221edb554cd69683b68a46fc0ee96881174c4214c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e737667)](LICENSE)

Vulnerability management built around [OWASP Dependency-Track](https://dependencytrack.org/). Dependency-Track is the engine and UI; A.S.E is the thin automation that feeds it and alerts from it. You hear about a CVE only when it affects something you actually run, in the Slack channel of the team that owns it, ranked by real-world exploitability.

> The original 1.0.0 A.S.E was a standalone feed-polling CLI; it lives on at tag [`mvp-final`](https://github.com/infinri/A.S.E/releases). The 2.x rebuild moved feed ingestion and version matching into Dependency-Track and kept the parts that earned their place: KEV/EPSS/CVSS scoring and the Slack alert format. Rationale and parity evidence: [docs/planning/](docs/planning/), [docs/parity-report.md](docs/parity-report.md).

How it fits together
--------------------

[](#how-it-fits-together)

```
composer.lock files ──┐
                      ├── bin/ase-sync ──> Dependency-Track