Vaigilmanual

Vulnerability management

Decide vulnerabilities, publish what you decided, and fix the ones that matter.

In the consoleVulnerabilities

  1. Import what is known

    vaigil vuln import --bom sbom.json --where api --osv osv.json --kev kev.json --epss epss.csv
vaigil vuln reach --source ./src --where api

    reach reads the asset's source for the symbols each open advisory names, and records what it found against that advisory.

  2. Say what each asset is

    vaigil vuln asset ISSUER:VALUE --exposure open --impact high --because "public API"

    Exposure is small, controlled or open; impact is low, medium, high or very high.

  3. Read the queue and the plan

    vaigil vuln queue
vaigil vuln plan
vaigil vuln why CVE-2026-0001

    The plan is the smallest set of upgrades that clears the most risk.

  4. Decide, and publish

    vaigil vuln assess CVE-2026-0001 PKG not_affected
vaigil vuln accept CVE-2026-0002 PKG --owner dana --until 2027-01-31 --because "..."
vaigil vuln vex --author "Example Ltd" --id https://example.com/vex/1

    The statuses are affected, fixed, not_affected and under_investigation. A risk acceptance names its owner, its end date and its reason.

Code and dependencies

vaigil sca scan --bom sbom.json --osv db.json
vaigil sarif read results.sarif
vaigil appsec triage