Skip to main content
Common Expression Language (CEL) is a safe, sandboxed expression language. SafeDep adopts it as the common syntax for filtering scan results, running queries, and writing policy rules. A CEL expression evaluates to true or false for each package, so you describe exactly which dependencies you care about.

​
Why it matters

One language covers three jobs: ad-hoc filtering during a scan, repeatable queries over saved scan data, and enforceable policy. You learn the syntax once and reuse it everywhere.

​
What you can reference

A CEL expression in Vet receives this data about each package:
VariableWhat it holds
pkgPackage coordinates: ecosystem, name, version
vulnsVulnerabilities by severity: all, critical, high, medium, low (each item has an id)
scorecardOpenSSF Scorecard data: score and per-check scores["Check-Name"]
projectsSource projects: name, type, stars, forks, issues
licensesSPDX license identifiers
A few expressions: 
vulns.critical.exists(x, true)
licenses.exists(p, p == "MIT")
projects.exists(x, x.stars < 100) && scorecard.scores.Maintained < 5
Hyphenated scorecard checks use the bracket form, for example scorecard.scores["Token-Permissions"].

Filtering

The full filter input structure and recipes.

Build Your Own Queries

Reuse CEL over saved scan data.

Policy

How CEL rules become enforceable policy.

Policy as Code

Write policy files with CEL.