conan audit checks Conan packages for known vulnerabilities. The scan subcommand examines a recipe or specific references plus their transitive dependencies, and by default it fails on any critical CVSS score of 9.0 or higher. The documentation marks it experimental, introduced in Conan 2.14.0, so treat results as one input.
The subcommands
| Subcommand | What it does |
|---|---|
| conan audit scan | Checks a recipe, or references given with the requires options, and their transitive dependencies |
| conan audit list | Lists vulnerabilities for a given reference, without expanding transitive dependencies |
| conan audit provider | Adds, lists, authenticates or removes providers of vulnerability data |
Because scan expands the dependency graph, it accepts profiles, settings, options and lockfiles. That matters: a dependency that applies only on one platform appears only if you scan with that configuration. Output can be JSON or HTML.
The list subcommand accepts a single reference, a package list file, a CycloneDX SBOM generated with the Conan tools, or a Conan lockfile.
Data source
By default the audit commands use the ConanCenter provider. The documentation says that besides ConanCenter, a private provider type is supported for other data sources. It does not describe the vulnerability data itself in detail, so ask yourself what is in scope before relying on it: packages not in ConanCenter, such as your own recipes or vendored code, may have no data.
Steps to use it
- Upgrade to Conan 2.14.0 or later.
- Run a scan against the same lockfile and profile you build with, so you audit what you ship.
- Decide the threshold. The default error level is critical, and you can change it with the severity level option.
- Save the JSON report as a CI artifact.
- Triage findings by asking whether the vulnerable function is used by your code, not only by the score.
Where it fits
A package audit answers one question: do any of the Conan packages in this graph have a known advisory? It does not answer whether the vulnerable code is reachable, nor does it cover CMake downloads or copied source. Pair it with an inventory that includes those, and with a policy for how fast fixes must land.
See how to pin C and C++ dependencies with a Conan lockfile so that what you audit is exactly what you build.
Try it yourself
Open the demo and see how findings are listed and what a fix looks like. Notice how severity alone does not tell you what to do first.
Click through it at your own pace, or open it full screen.
Quick check
Does conan audit fail the build by default?
Scan raises an error for any critical CVSS score, 9.0 or higher, unless you change the level.
Does it scan my copied or fetched libraries?
It checks Conan packages. Libraries outside Conan need another way to be inventoried and checked.
Safeguard's SBOM and dependency scanning can build an inventory of the components in a repository, and the free scan at gold.safeguard.sh/scan is a quick way to see what turns up.
Sources
Last reviewed: 19 October 2026.
