Environment variables

Flags win over environment variables wherever both exist. Variables used only by one product’s commands (the runtime sensor, the SIEM forwarder, the AI Firewall) are documented in that product’s segment.

Credentials

Read in this order; the first complete source wins. See Credential precedence.

Variable	Meaning
VULNETIX_API_TOKEN	Bearer token. Outranks every other source.
VULNETIX_API_KEY	ApiKey. Used only together with VULNETIX_ORG_ID. A leading <org>: is stripped.
VULNETIX_ORG_ID	Organisation UUID for the ApiKey; also the --bom-manufacturer fallback and the --noninteractive login org
VVD_ORG, VVD_SECRET	SigV4 organisation and secret. Used only as a pair.
VULNETIX_CREDENTIALS_DIR	Directory of the home credentials file instead of ~/.vulnetix (read and write)

Endpoints

Variable	Default	Meaning
VULNETIX_API_URL	https://api.vdb.vulnetix.com	VDB API base for scan and the language server, for a mock or self-hosted API. upload --base-url sets it for that run.
VULNETIX_WEB_URL	https://www.vulnetix.com	Site base for the browser login’s device endpoints
GITHUB_API_URL	https://api.github.com	GitHub API for gha upload and the gha posture commands (GitHub Enterprise Server)

GitHub

Variable	Read by
GITHUB_TOKEN	gha upload (required to list the run’s artifacts), analyze, gha posture commands, triage, licence lookups
GH_TOKEN	analyze, gha posture commands, triage, licence lookups, after GITHUB_TOKEN. Then gh auth token.
GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT	gha upload and gha status (the run to read), gha posture commands (--repo default)
GITHUB_STEP_SUMMARY	scan appends a Markdown summary when set
GITHUB_ACTIONS, GITLAB_CI, CI_JOB_ID, TF_BUILD, BITBUCKET_BUILD_NUMBER, JENKINS_URL, BUILD_NUMBER, KUBERNETES_SERVICE_HOST, …	Platform detection; see env

Deployment labels and BOM identity

Fallbacks for the scan-family flags, first set value wins. See scan.

Variable	Flag
VULNETIX_PROJECT, then CI_PROJECT_NAME	--project
VULNETIX_ENVIRONMENT, then CI_ENVIRONMENT_NAME, ENVIRONMENT_NAME	--environment
VULNETIX_CLUSTER, then CLUSTER_NAME, KUBERNETES_CLUSTER_NAME	--cluster
VULNETIX_NAMESPACE, then POD_NAMESPACE, KUBERNETES_NAMESPACE	--namespace
VULNETIX_BOM_MANUFACTURER	--bom-manufacturer

Output, banner and analytics

Variable	Effect
CI=true	No banner; no analytics unless also under GitHub Actions; superseded-flag notes are not printed
DO_NOT_TRACK=1	No banner, no analytics, no install-script ping
VULNETIX_NO_ANALYTICS	Any value: no analytics. 1: no install-script ping.
VULNETIX_ARTIFACT_MANIFEST	Path of the artifact manifest, as --artifact-manifest
NO_COLOR	No colour (as --color never)
COLUMNS	Output width when not a terminal and --width is not set

Caches

Variable	Default location	Effect
VULNETIX_SAST_CACHE_DIR	<user cache dir>/vulnetix/sast	SAST rule-result cache; point a CI cache step here. --no-cache turns it off.
VULNETIX_GRAPH_CACHE_DIR	<user cache dir>/vulnetix/graph	Per-file graph facts cache for analyze and scans
VULNETIX_MALSCAN_DEFS_DIR	<user cache dir>/vulnetix/malscan/definitions	Malscan threat-intel definitions
VULNETIX_NO_TOKEN_CACHE	~/.vulnetix/cache/tokens	Any value: do not keep SigV4 tokens on disk
VULNETIX_NO_LICENSE_CACHE	~/.vulnetix/cache/licenses	Any value: do not keep licence lookups
VULNETIX_NO_BINARY_CACHE	~/.vulnetix/cache/binaries	Any value: do not keep binary version detections

<user cache dir> is ~/.cache on Linux (or $XDG_CACHE_HOME), ~/Library/Caches on macOS and %LocalAppData% on Windows. VDB responses are cached under ~/.vulnetix/cache/vdb/, one directory per CLI version; old versions are cleaned at start.

Tuning

Variable	Default	Effect
VULNETIX_SCA_CONCURRENCY	6 (1 to 16)	Parallel cli.sca requests
VULNETIX_SCA_TIMEOUT	75 seconds (10 to 300)	Per-request limit for cli.sca
VULNETIX_SAST_WORKERS	CPU count	Concurrent rule evaluations
VULNETIX_SAST_SHARDS	by CPU count and rule count	Concurrent compile and evaluate shards; 1 compiles once
VULNETIX_SAST_NO_LANG_FILTER	unset	Any value: run rules for languages absent from the repository too
VULNETIX_REACHABILITY_CONCURRENCY	CPU count (1 to 32)	Files analysed in parallel by reachability
VULNETIX_GRAPH_WORKERS	CPU count	Parallel file parsing for the graph
GOMEMLIMIT	75% of the cgroup memory.max or physical memory	A scan sets a soft Go memory limit so the GC works harder before the kernel kills it. An explicit GOMEMLIMIT wins.

Debugging

Variable	Effect
VULNETIX_HTTP_TRACE	Any value: one stderr line per VDB request with start offset, duration, status, method, URL and connection setup time, e.g. [http#5] + 2241ms 3836ms 200 POST api.vdb.vulnetix.com/v2/cli.sca net=0ms
VULNETIX_PPROF_DIR	Write cpu.pprof (and other profiles) for the run into this directory

Install script

Variable	Default	Effect
INSTALL_DIR	/usr/local/bin	Same as --install-dir
VERSION	latest	Same as --version