SCA quickstart

Install the CLI first: see Install.

1. Scan

cd your-project
vulnetix sca

The scan walks three directory levels below --path (default .). Raise it for deep monorepos:

vulnetix sca --path . --depth 6

Commit a lockfile, or install dependencies first, for every manifest that declares ranges. A package.json or requirements.txt with neither a lock nor installed packages is skipped with a note. See Lockfiles and resolution.

2. Read the results

The default view groups findings by package in a terminal and prints plain text in a pipe or CI. Useful switches:

vulnetix sca --view findings              # one row per advisory
vulnetix sca --filter kev,reachable       # only KEV-listed findings your code reaches
vulnetix sca --min-severity high          # hide low and medium (display only)
vulnetix sca --show paths                 # how each transitive package was introduced
vulnetix sca --explain CVE-2021-23337     # why one finding applies, with the evidence

3. Gate a build

vulnetix sca --fail-on high,malware,kev

Exit 1 means a gate was breached. --min-severity never changes the exit code; --fail-on does. When the scan runs under an organisation with a quality gate, the organisation’s values replace yours. See Gates and exit codes.

GitHub Actions:

- name: SCA
  run: vulnetix sca --fail-on high --output sbom.cdx.json
  env:
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}

4. Export

vulnetix sca --output json-cyclonedx > sbom.cdx.json     # CycloneDX to stdout
vulnetix sca --output sca.report.json --output sbom.cdx.json   # files, by extension

See Output formats.

5. Fix

vulnetix fix --dry-run    # the plan, nothing changed
vulnetix fix --yes        # apply it, no prompts

fix edits manifests, runs your package manager, rescans and writes VEX for what it resolved. See vulnetix fix.