Supply-chain hygiene
Homebrew vulnerability scanning on macOS
A developer Mac accumulates software the way a garage accumulates tools. Most of it was installed for one job, years ago, and has not been looked at since. Homebrew is very good at putting that software on your machine. It has nothing to say about what happens to it afterwards — and some of it now has published CVEs.
What the brew CLI covers
brew outdated tells you what has a newer version. brew doctor tells you when your installation itself is unhealthy. Both are genuinely useful, and neither is a security check — "newer exists" and "what you have is vulnerable" are different questions with different urgency.
What it doesn't
brew audit is the command people reach for and the one that misleads most: it validates that a formula is well-formed for submission to Homebrew. It is a check on the recipe, not on the software sitting on your disk. Nothing in the default toolchain compares your installed versions against an advisory database.
How it works
What EasyHomebrew actually does when it scans
Collect
Every installed formula and cask is gathered with its version — the same list brew list --versions would give you, without the copy-paste.
Match
Those packages are queried against OSV in batches. The lookup is live, so a scan reflects the advisories published up to the moment you run it.
Rank
Each result carries the advisory's own severity where it publishes one, falling back to its CVSS score. The worst finding for a package is what shows on the package row.
Act
Every finding links out to the official advisory, and the outdated list is one click away — usually the fix is simply the patched version.
The database: OSV
Findings come from OSV, the open-source vulnerability database maintained by Google, queried live rather than shipped as a snapshot inside the app. That matters for the thing this page is about: a database baked in at release time is already stale by the time you install the app, and staleness is the entire failure mode being solved for.
Reading a finding
What the severities mean in practice
Remotely exploitable, or trivially so. Worth acting on today.
Serious, usually with conditions attached. Worth this week.
Real but narrow — often needs local access or an unusual configuration.
Severity comes from the advisory itself where the publisher provides one, falling back to its CVSS score. A package showing several findings is ranked by its worst one, so the row you see in the list is the row you should judge it by.
And when the problem is the installation itself
Brew Doctor covers the other half of machine hygiene — the state of Homebrew rather than the packages in it. It splits into two kinds of warning, and the difference is deliberate:
Runnable
Unlinked kegs, missing dependencies, deprecated formulae, invalid cask metadata — brew offers a command for these, so Doctor gives you a "Run fix" button and re-runs the check afterwards.
Copy-only
A sudo command, a PATH change, an xcode-select call — these belong in your shell, not in an app running commands on your behalf. Doctor surfaces them as copyable commands and leaves the decision to you.
A scan you have to remember to run is a scan you won't run
This is the part that decides whether any of it works. Scanning on demand answers the question "am I exposed right now" — but advisories are published continuously, and the gap between publication and discovery is where the exposure lives. A vulnerability you learn about three months late is not meaningfully different from one you never learned about at all.
So the scan runs at startup by default, and a menu-bar agent re-checks on the interval you set and marks itself when something turns up. You do not have to remember anything. That is the whole design: the alert finds you, rather than waiting for you to go looking for it.
Requires macOS 14 (Sonoma) or later, Apple Silicon or Intel.
Questions about Homebrew and CVEs
- Does brew audit check for security vulnerabilities?
- No. `brew audit` validates that a formula is well-formed for submission to Homebrew — style, licensing, and packaging rules. It is a check on the recipe, not on the software you installed, and it will not tell you that the version on your disk has a published CVE.
- How do I check which installed Homebrew packages have known vulnerabilities?
- You need to compare what you have installed against a vulnerability database. EasyHomebrew does it automatically: it collects your installed formulae and casks, queries the OSV database in batches, and lists what comes back by severity. Doing it by hand means running `brew list --versions` and looking each package up yourself.
- Which vulnerability database does EasyHomebrew use?
- OSV (osv.dev), the open-source vulnerability database maintained by Google. It aggregates advisories across ecosystems and is queried live, so a scan reflects what is published at the moment you run it rather than a list baked into the app at release time.
- How often does it re-check?
- A scan runs at app startup by default, and the menu-bar agent re-checks on the interval you choose and marks the status item when something turns up. You can also scan on demand from the Security screen at any time.
- Does my package list get sent to a server?
- Package names are sent to the OSV API to be matched against advisories — that is what a live lookup requires. Nothing is sent to Wizhut.tech, there is no account, and the scanning is not tied to any profile of you. The privacy policy has the specifics.
Find out what you're running
One scan tells you whether anything on your Mac has a known vulnerability — and the menu-bar agent keeps telling you from then on. A one-time €10 purchase.