Skip to main content
Vibgrate Graph: over 24% fewer tokens, same results

Configuration

Configuration management

8
FAQs

FAQs

How do I set up the DSN (Data Source Name) for dashboard uploads?

Set the VIBGRATE_DSN environment variable with your DSN token. System-wide: add export VIBGRATE_DSN="your-dsn" to ~/.zshrc or ~/.bashrc (macOS/Linux) or set via System Properties > Environment Variables (Windows). Project-level: add to your .env file (never commit this). In CI, store as a secret (GitHub Secrets, Azure DevOps Variables, GitLab CI Variables).

What are the best practices for managing the VIBGRATE_DSN?

Never commit DSN tokens to source control. Store DSNs as CI/CD secrets. Use separate DSNs for different environments (dev, staging, production) if needed. Rotate DSN tokens periodically. For local development, add VIBGRATE_DSN to your .env file and ensure .env is in .gitignore. In CI, always use the secret manager provided by your platform.

How do I set environment variables on macOS?

For zsh (default on modern macOS): add export VIBGRATE_DSN="your-dsn" to ~/.zshrc, then run source ~/.zshrc. For bash: add to ~/.bash_profile or ~/.bashrc. For a single session: run export VIBGRATE_DSN="your-dsn" directly in terminal. Project-level: create a .env file with VIBGRATE_DSN=your-dsn and use a tool like direnv or dotenv to load it.

How do I set environment variables on Windows?

GUI method: Search 'Environment Variables' > Edit system environment variables > Environment Variables button > User variables > New > Name: VIBGRATE_DSN, Value: your-dsn. Command line (current session): set VIBGRATE_DSN=your-dsn (cmd) or $env:VIBGRATE_DSN="your-dsn" (PowerShell). Persistent via PowerShell: [Environment]::SetEnvironmentVariable('VIBGRATE_DSN', 'your-dsn', 'User'). Restart terminals after changes.

How do I configure Vibgrate?

Create a vibgrate.config.ts (or .js/.json) file in your project root. Configure exclude patterns to skip directories, thresholds to control finding severity (eolDays, frameworkMajorLag, dependencyTwoPlusPercent), and scanners to enable/disable extended scanners. Run vg init to generate a default config file. For one-off runs you can also add excludes on the command line with vg scan --exclude <glob> (alias -e), which are merged with the config exclude list.

Can I run Vibgrate without internet access?

Yes. Use --offline with --package-manifest ./latest-packages.zip (pre-downloaded manifest). Download the manifest from github.com/vibgrate/manifests on a connected machine, transfer to your air-gapped environment, then run offline scans. Offline scores are as current as the manifest file. Pushing to Vibgrate Cloud is unavailable in offline mode.

Should I add .vibgrate to .gitignore?

Add .vibgrate/scan_result.json to .gitignore (it changes on every scan). Keep .vibgrate/baseline.json in version control so CI can compare against it and all branches use the same reference. The generated vibgrate.config.ts should also be committed.

What does --max-privacy mode do?

--max-privacy enables hardened privacy mode: runs only minimal scanners, writes no local artifacts (.vibgrate/*.json), and reduces data collection to the bare minimum needed for drift scoring. Use this in highly regulated environments or when you want to minimize any local file writes.