Vibgrate Graph: over 40% fewer tokens, same results Your AI re-reads your whole repo every question. Vibgrate Graph maps it once — over 40% fewer tokens, same results. Free — see the benchmark

Vulnerabilities

12 items tagged with "vulnerabilities"

Filter by type:

Standards1

OWASP Top 10:2025

The ten most critical web application security risks, refreshed from contributed vulnerability data. The 2025 edition adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, keeps Broken Access Control at number one, and absorbs server-side request forgery into it.

Best Practices1

CycloneDX SBOM Specification

Lightweight Bill-of-Materials standard for software components, vulnerabilities, and licenses.

Tutorials2

How to scan container images for vulnerabilities with Trivy

Find OS and dependency CVEs in container images locally and in CI, and fail builds above a severity threshold.

How to Scan Dependencies for Vulnerabilities in CI

Generate an SBOM, scan dependencies against vulnerability databases, gate merges on severity, and automate upgrade pull requests.

FAQs8

How do I gate pull requests on known vulnerabilities with GitHub Actions?

Use the maintained vibgrate/cli Action: `uses: vibgrate/cli@v1` with `vulns: true`, `fail-on: error`, and `upload-sarif: true`. It scans installed dep...

What is a CVE and what is CVSS?

A CVE (Common Vulnerabilities and Exposures) is a unique public identifier, such as CVE-2021-44228, assigned to a specific known security vulnerabilit...

How do I scan for known vulnerabilities?

Run `vg scan --vulns`. It matches every installed dependency against the public OSV database and reports known vulnerabilities with advisory id and CV...

Can I scan for vulnerabilities offline or air-gapped?

Yes. `vg scan --vulns` queries the OSV database over the network by default, but you can supply advisories in a package-version manifest and run fully...

Which ecosystems support vulnerability detection and attribution?

Detection and attribution read each project's lockfile, covering npm / pnpm / yarn, pip / poetry / pipenv, cargo, composer, bundler, go, pub, hex, NuG...

What are CRA remediation metrics?

When `vg scan --vulns` runs in a git repository, Vibgrate attributes each vulnerability to the commit that introduced the affected version and measure...

Does Vibgrate measure real mean time to remediate (MTTR)?

Yes. As well as how long open vulnerabilities have been exposed, Vibgrate reconstructs closed exposure windows from git history — a vulnerable version...

What does vg scan --full do?

`vg scan --full` runs a comprehensive scan in one command: the normal DriftScore, known-vulnerability detection (the same as `--vulns`), and, when a s...