Only if you put them there. A header-only library is compiled straight into your own code, so there is no separate library file to find in the build output. An inventory built from binaries will miss it. One built from a package manager manifest or a pinned source copy can include it.
What header-only means
A header-only library is delivered entirely as header files. You include them, and the compiler builds the library code as part of your translation units. There is no .so, .dll or .a file to link.
That is convenient for builds. It is awkward for security records, because many tools look for libraries as files.
Where a header-only dependency can come from
| Source | Visible to a manifest scan | Typical risk |
|---|---|---|
| Package manager such as Conan or vcpkg | Yes, in the manifest or lockfile | Low, if pinned |
| CMake FetchContent or a Meson wrap | Only if the scanner reads those files | Medium, see below |
| Git submodule | Only as a commit pointer | Medium |
| Copied into the repository | Rarely | High, version often unknown |
Copying a single header into the tree is the worst case. The file may carry a version comment, or nothing at all.
Why it matters
A vulnerability in a header-only parser still ships in every binary that included it, and fixing it means rebuilding each of them. Without a record of which products included which version, you cannot answer an advisory quickly.
Related reading: does CMake FetchContent hide dependencies from scanners, git submodules and vulnerability scans, and vendored code and license scanning blind spots.
How to record them on purpose
- Prefer getting header-only libraries from a package manager, so they land in a manifest.
- If you vendor a header, put the upstream project name, version and source URL in a comment at the top and in a small file next to it.
- Add the vendored item to your SBOM by hand or through a step in your build, using a purl. See which purl type for C and C++ libraries.
- Review changes to vendored headers in pull requests, since a hand edited copy is a fork.
- Include the item in your update checklist, as in dependency update checklist after an advisory.
What to avoid
Do not assume that because nothing is linked, nothing is there. Do not trust a version comment you did not verify against the upstream release.
Where Safeguard fits
Safeguard's dependency scanning and SBOM generation work from manifests and repository contents. The more of your dependencies are declared, the more complete the inventory. Try the free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which entries are declared directly, and think about which of your header-only libraries would appear.
Quick check
Is a header-only library a dependency?
Yes. Its code is compiled into your product, so a vulnerability in it affects you even though no library file is shipped.
What is the least safe way to include one?
Copying a header into the tree with no version record, because nothing can tell you later which release you took.
Last reviewed: 19 October 2026.
