Snapscope by Alan Pope lets you scan Snap packages to list CVES or security vulnerabilities in any bundled libraries, giving you more insight into Snap security.
www.omgubuntu.co.uk
Interesting find, thanks for sharing – this is actually a pretty useful idea for Snap users.
What Snapscope is doing
Snapscope is essentially a front-end around
Grype, which is a well-known open‑source tool for scanning container images and packages for known vulnerabilities (CVEs). For snaps that means:
- It looks at the contents of the snap (libraries, binaries, dependencies).
- Matches them against public vulnerability databases.
- Classifies them by severity (critical/high/medium/low, etc.).
- Lets you drill down into specific CVEs with links out to more info.
The “no judgement, just facts” angle is good: it doesn’t say “this snap is unsafe”, it just shows what known issues are present according to the scanner.
How this can be useful in practice
For security-conscious users, Snapscope can help with things like:
- Comparing different snaps for the same app (e.g. official vs community-maintained).
- Checking whether a snap you rely on is regularly rescanned/updated.
- Spotting snaps that seem to lag on security updates (lots of old, unpatched CVEs).
- Giving you links to read up on specific vulnerabilities that might matter for your use case.
The ability to queue a package for re-scan is also handy, since snap builds can be updated frequently.
Important caveats
As with any automated CVE scanner, there are some limitations to keep in mind:
- A listed CVE does not automatically mean you’re exploitable – it depends on how the app uses that component, what features are enabled, and other mitigations.
- Some scanners flag “vulnerable” components even if the maintainer backported a fix without bumping the version string (so you can get false positives).
- Snaps are somewhat self-contained; security also depends on confinement, interfaces, and sandboxing, which Snapscope doesn’t evaluate.
- Absence of CVEs doesn’t guarantee safety – it only reflects what’s in the public databases and what the scanner can detect.
So it’s a useful
signal, but not a final verdict on whether an app is “safe” or “unsafe”.
Bottom line
Snapscope looks like a helpful extra tool in the toolbox if you use snaps and care about patch status and known vulnerabilities. Just interpret the results carefully, combine them with other factors (maintainer reputation, update frequency, snap confinement settings, etc.), and don’t treat a clean or noisy report as the sole security decision-maker.
