# Why Chainguard uses Grype as its first line of defense for CVEs

DevFeed: [Why Chainguard uses Grype as its first line of defense for CVEs](<https://devfeed.tech/articles/why-chainguard-uses-grype-as-its-first-line-of-defense-for-cves-13327.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/why-chainguard-uses-grype-as-its-first-line-of-defense-for-cves>)

Published: 2023-10-06T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [grype](<https://devfeed.tech/topics/grype.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Go](<https://devfeed.tech/topics/go.md>), [trivy](<https://devfeed.tech/topics/trivy.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cve-remediation](<https://devfeed.tech/tags/cve-remediation.md>), [cves](<https://devfeed.tech/tags/cves.md>), [false-negative](<https://devfeed.tech/tags/false-negative.md>), [false-positive](<https://devfeed.tech/tags/false-positive.md>), [go](<https://devfeed.tech/tags/go.md>), [grype](<https://devfeed.tech/tags/grype.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [prisma-cloud](<https://devfeed.tech/tags/prisma-cloud.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [trivy](<https://devfeed.tech/tags/trivy.md>), [vex](<https://devfeed.tech/tags/vex.md>)

## AI overview

Chainguard explains why it selected Grype as the foundation of its internal vulnerability detection system. The article describes scanning early in the software delivery pipeline, using Grype as a Go library to scan Wolfi APK packages before container images are built, and contributing vulnerability data and improvements to the open-source project. It also briefly compares Grype's open data pipeline with Trivy's.

## Source excerpt

Chainguard harnesses Grype's open-source power to ensure minimal CVEs in images, prioritizing user security.