Overview
Endor Labs focuses on software supply chain security — specifically dependency lifecycle management and reachability analysis. Rather than surfacing every CVE in a dependency tree, Endor Labs identifies which vulnerabilities are actually reachable from your code’s call paths. The Pwnbook integration imports these findings so teams can prioritize remediation based on real exploitability.Prerequisites
- An Endor Labs account with API access
- Admin or Owner access in Pwnbook
Credentials required
| Field | Description |
|---|---|
| API Key | API key from Endor Labs Settings → API Keys |
| Namespace | Your Endor Labs namespace (organization identifier) |
Setup
Create an Endor Labs API key
- In Endor Labs, go to Settings → API Keys.
- Click Create API Key.
- Give it a name like “Pwnbook” and assign Read permissions.
- Copy the API key and note your namespace.
What gets synced
| Data | Description |
|---|---|
| Dependency vulnerabilities | CVEs in your direct and transitive dependencies |
| Reachability | Whether the vulnerable code path is reachable from your application |
| Severity | Critical, high, medium, low — adjusted by reachability |
| Dependency versions | Current version, fixed version, and upgrade path |
| EPSS score | Exploit Prediction Scoring System score for prioritization |
| Package ecosystem | npm, PyPI, Maven, Go modules, etc. |
Reachability analysis
Endor Labs’s key differentiator is call-graph-based reachability analysis. Pwnbook surfaces this:- Findings are tagged Reachable, Unreachable, or Unknown
- Reachable findings are sorted to the top of the findings list
- Unreachable findings can be filtered out to reduce noise
Viewing findings in Pwnbook
Endor Labs findings appear under Security Findings → Endor Labs. You can:- Filter by reachability status, severity, and package ecosystem
- View CVE details, CVSS scores, and EPSS scores
- See the dependency chain from your application to the vulnerable package
- Assign findings to tasks
Disconnecting
- Go to Organization Settings → Marketplace → Endor Labs.
- Click Disconnect.
- Confirm.