Asset relationships and labels

Vulnetix has no hand-maintained asset register. Relationships come from evidence (what a scan or vulnetix analyze observed) and labels come from the threat model. This page lists what exists today.

The tech stack graph

vulnetix analyze builds a graph of each repository and uploads it. Overview › Tech Stack Graph (/resolve/graph) draws it.

Node kind	Is
repo, file, function, class	Code structure
dependency	A package resolved from a registry. Carries its purl.
route, service, workflow	HTTP routes, services, CI workflows
contributor	A person who committed
egress_domain	A host the repository reaches out to, from a manifest or written in a file. Not a package.

Edges are contains, imports, calls, depends_on, handles_route, authored and others. Each edge carries a confidence and how it was resolved (exact, lexical, type-binding, import, wildcard, global, heuristic, unresolved). An unresolved import still produces a low-confidence edge, so filter on confidence rather than assume every edge is fact.

A node id (<kind>:<qualifiedName>) is not stable across runs for code symbols. Join across runs on path and name, or on purl.

Relationships between repositories

Each repository’s analysis publishes what it provides and what it consumes, each as a join kind and a normalised key. Vulnetix forms an org-wide edge where one repository consumes what another provides, matching the key exactly. The edge always points from the consumer to the provider, and its confidence is the lower of the two sides.

Join kind	Key
PACKAGE	purl
HTTP_ROUTE	METHOD /normalized/path/{param}
GRPC_METHOD	package.Service/Method
TOPIC	topic name
CONTAINER_IMAGE, CONTAINER_REGISTRY	image reference, registry
DATABASE, SERVICE, WORKFLOW, SYMBOL	the fully qualified name
IAC_RESOURCE, IAC_PROVIDER, TERRAFORM_MODULE, TERRAFORM_PROVIDER, TERRAFORM_REGISTRY, HELM_CHART, HELM_REGISTRY, NPM_REGISTRY, MAVEN_REGISTRY	the module, chart or registry

The org graph is rebuilt from the latest runs; it describes the estate now, not its history.

Method	Path
GET	/v1/insights/graph
GET	/v1/insights/graph/{repoId}/nodes, /v1/insights/graph/{repoId}/intel
GET	/v1/insights/node/{repoId}/{nodeId}
GET	/v1/insights/org/metrics

Cloud resources

A connected AWS account’s cloud scan attributes each resource to the repository that deploys it and records the software observed on it. That is the link internet exposure uses. See /cloud-security/.

Labels

Labels are threat model annotations on a graph node or edge, on Overview › Threat Model (/resolve/threat-model). They belong to the repository and node, not to one saved threat model, so they outlive any view. Pro and above.

kind	value is
LABEL	Free text. Not unique: reusing an existing label is how nodes group.
TRUST_BOUNDARY	The boundary name. Nodes with the same value are drawn in one hull.
SENSITIVE	Sensitivity marker
SECRET_KEY	Key marker
INTERNET_REACHABILITY	Reachability, derived from graph data where possible
THREAT	finding (with a findingUuid) or a derivation key such as exposed-secrets
EXPECTED_ENTRY	An entry point someone meant to expose, such as a login page. Only a person asserts these.
UNINTENDED_ENTRY	A way in that evidence says exists and nobody asked for. Derived.

A value is at most 120 characters.

Method	Path	Notes
GET	/v1/threat-model/annotations?repoId=
POST	/v1/threat-model/annotations	repoId, exactly one of nodeId or edgeId, kind, value, note, findingUuid. A finding must be yours.
PATCH	/v1/threat-model/annotations/{id}	value and note only. To move one, delete and create.
DELETE	/v1/threat-model/annotations/{id}
GET	/v1/threat-model/annotations/labels?q=&kind=	Prefix lookahead over the labels you already use
POST	/v1/threat-model/annotations/derive	Derive annotations from evidence

GitHub custom properties

Repository custom properties set on GitHub (team, tier, data class) are read through the GitHub App and can scope Software Factory workflow triggers. They are not yet a filter on findings or campaigns. See /software-factory/.

Not there yet

• There is no API to tag a repository, finding or package with your own labels outside the threat model. The schema has older Tags and collection tables, but no current route reads or writes them.
• There is no owner or business-criticality field on a repository. Campaign contributors and code-owner suggestions are the nearest thing.
• Config-as-code for labels is planned and described on /platform-iac/.