Answer the exposure question with signed evidence.
When a vulnerability lands, someone asks: are we affected? With a spreadsheet, the answer arrives days later. Vibgrate Evidence tells you which shipped products contain it — at which versions, in which markets, still in support — in seconds, as reproducible evidence you can verify offline.
One question, one command
Register your products, freeze each shipped release into an immutable component manifest, then ask the one question that matters at hour 23.
$ vg evidence exposure CVE-2026-48282 --regime cra --offline --advisory advisory.json
EXPOSURE FOUND — 3 products · 3 shipped releases
Product Shipped versions Markets Support
─────────────────────────────────────────────────────────────
SentinelGate 4.x 4.2.0 DE FR NL BE in support
SentinelGate 3.x 3.9.4 DE FR in support
EdgeRelay 2.1.3 ES IT PT in support
Coordinator NCSC-NL
Filing person Jordan Alvarez · authority: yes
Advisory CVE-2026-48282 (advisory.json)
Evidence EXWPGM15D3KP4N5G2075QCNRDJ deterministic · kernel evidence-1
data-pack none · timestamp local-clock
Next → vg evidence pack CVE-2026-48282 --regime cra --stage=early-warningReal CLI output on example data. Exit codes are CI-usable: 0 no exposure · 2 exposure · 3 undetermined · 1 error.
Evidence an auditor can accept
Frozen at ship time
Every scanner tells you what is in your repository today. A regulator is asking about the firmware you shipped in 2023. Vibgrate freezes each release manifest at ship time and never regenerates it, so the answer is about what you actually shipped.
Deterministic — no model touches the number
Same repository state, same data pack, byte-identical answer — now and years from now. A language model can help draft the covering narrative for a notification. It never decides whether you shipped the library.
Signed and independently verifiable
Every answer is an evidence bundle with a detached Ed25519 signature. A third party can verify it offline, with no Vibgrate account and no network connection, with honest verified / unverified / failed states.
Works air-gapped
Your incident response cannot depend on our uptime. The whole evidence path runs against a local advisory file with the cable unplugged.
Says "I don't know" when it doesn't know
Where a manifest is missing, Vibgrate returns undetermined with a reason. It never interpolates. A false "not affected" here would be your problem, not our rounding error.
One engine, many regimes
Reporting duties are modeled as regimes. The EU Cyber Resilience Act is the first; DORA incident reporting ships alongside it. As other jurisdictions introduce similar duties, each one plugs in as a profile — vg evidence exposure … --regime <id> — not a new command. The command set stays open.
EU Cyber Resilience Act
Regulation (EU) 2024/2847 · 24-hour early warning, 72-hour notification, 14-day final report, filed through the ENISA Single Reporting Platform.
DORA incident reporting
Regulation (EU) 2022/2554 · major ICT-related incident reporting, from the same deterministic engine.
Try it
Install the Vibgrate CLI, then run vg evidence regimes to get started.
# Run without installing anything
npx @vibgrate/cli scan
# Pin a version or see every command
npx @vibgrate/cli@latest --helpno install·Nothing is installed globally — ideal for CI or a one-off scan.
vg evidence init --coordinator NCSC-NL --responsible "Jordan Alvarez" --filing-authority vg evidence product add "Acme Edge Gateway" --markets DE,FR,NL --in-scope --until 2031-01-01 vg evidence release acme-edge-gateway 4.2.0 --from .vibgrate/scan_result.json vg evidence readiness
What we don’t do
We don’t file for you
We produce the filled pack; your named person submits it through the reporting platform.
We don’t decide “actively exploited”
We surface the KEV listing and the evidence. The determination is yours.
We don’t make you compliant
Compliance is determined by you and, where applicable, a notified body. We produce evidence. We hold to that distinction.
We’re not lawyers
Nothing here is legal advice. Confirm your obligations with counsel.
Run your first drill before you need it
vg evidence drill times a dry run of the determination against a simulated advisory built from a component you actually ship — so the first attempt isn’t the real one.
Keep reading
Vibgrate Evidence produces evidence to support your obligations under a regime. It does not determine compliance, is not a certification, and is not legal advice.
See the CLI in action
A replay of the actual CLI registering a product with digital elements, freezing a shipped-release manifest, and reporting CRA readiness. Nothing executes in your browser.