FerroSCA — development record
FerroSCA is a Rust-native SBOM / SCA and vulnerability-management server — CycloneDX and SPDX ingestion, dependency and vulnerability tracking, policy evaluation — shipped as a single binary. Live on AWS Marketplace.
Measured record (as of 2026-07-10)
| First commit | 2026-05-02 |
| v1.0.0 GA | 2026-05-06 — four days later, after the diligence gate below |
| Commits | 310 |
| Rust code lines (tokei) | 294,842 |
| Test annotations (tracked) | 16,384 — a large share is generated conformance tests, which is why this number is high relative to commits |
| Latest activity | 2026-07-05 |
Quality gates passed
- Final adversarial diligence round: 0 Critical / 0 High findings remaining, 13,283 tests passing (2026-05). Diligence rounds are run by a competing vendor’s model against the codebase, repeated until two consecutive rounds surface nothing new.
- Workspace-wide
clippy::unwrap_usedenforcement;cargo auditclean at GA.
Honest limitations
- The 16K test-annotation count includes generated tests; the meaningful figure is the 13,283-test gated suite above.
- SCA coverage tracks the ecosystems FerroRepo serves first (OCI, Cargo, Maven, PyPI); breadth beyond those is roadmap, not product.
- Deployment guidance is EC2-single-node today. Multi-node HA is not claimed.