SafeDep VET

# macOS & Linux
brew install safedep/tap/vet

# Scan current directory
vet scan -D .

# Scan a single file
vet scan -M package-lock.json

# Fail CI on critical vulnerabilities
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail

# Fail CI on OpenSSF Scorecard requirements
vet scan -D . --filter 'scorecard.scores.Maintained < 5' --filter-fail

# Fail CI if a package is published from a GitHub repository with less than 5 stars
vet scan -D . --filter 'projects.exists(p, p.type == "GITHUB" && p.stars < 5)' --filter-fail

# Block packages with critical CVEs
vet scan \
--filter 'vulns.critical.exists(p, true)'

# Enforce license compliance
vet scan \
--filter 'licenses.contains_license("GPL-3.0")'

# Enforce OpenSSF Scorecard requirements
# Require minimum OpenSSF Scorecard scores
vet scan \
--filter 'scorecard.scores.Maintained < 5'

- uses: safedep/vet-action@v1
  with:
    policy: ".github/vet/policy.yml"

include:
  - component: gitlab.com/safedep/ci-components/vet/scan@main

docker run --rm -v $(pwd):/app ghcr.io/safedep/vet:latest scan -D /app

brew tap safedep/tap
brew install safedep/tap/vet

go install github.com/safedep/vet@latest

# Quick test
docker run --rm ghcr.io/safedep/vet:latest version

# Scan local directory
docker run --rm -v $(pwd):/workspace ghcr.io/safedep/vet:latest scan -D /workspace

vet version
# Should display version and build information

# Scan current directory
vet scan

# Scan a given directory
vet scan -D /path/to/project

# Resolve and scan transitive dependencies
vet scan -D . --transitive

# Package managers
vet scan -M package-lock.json
vet scan -M requirements.txt
vet scan -M pom.xml
vet scan -M go.mod
vet scan -M Gemfile.lock

# Setup GitHub access
vet connect github

# Scan repositories
vet scan --github https://github.com/user/repo

# Organization scanning
vet scan --github-org https://github.com/org

# Container images
vet scan --image nginx:latest
vet scan --image /path/to/image-saved-file.tar

# Binary artifacts
vet scan -M app.jar
vet scan -M package.whl

# Security-first scanning
vet scan -D . \
  --filter 'vulns.critical.exists(p, true) || vulns.high.exists(p, true)' \
  --filter-fail

# License compliance
vet scan -D . \
  --filter 'licenses.contains_license("GPL-3.0")' \
  --filter-fail

# OpenSSF Scorecard requirements
vet scan -D . \
  --filter 'scorecard.scores.Maintained < 5' \
  --filter-fail

# Popularity-based filtering
vet scan -D . \
  --filter 'projects.exists(p, p.type == "GITHUB" && p.stars < 50)' \
  --filter-fail

# Scan a CycloneDX SBOM
vet scan -M sbom.json --type bom-cyclonedx

# Scan a SPDX SBOM
vet scan -M sbom.spdx.json --type bom-spdx

# Generate SBOM output
vet scan -D . --report-cdx=output.sbom.json

# Package URL scanning
vet scan --purl pkg:npm/lodash@4.17.21

# Scan once, query multiple times
vet scan -D . --json-dump-dir ./scan-data

# Query with different filters
vet query --from ./scan-data \
  --filter 'vulns.critical.exists(p, true)'

# Generate focused reports
vet query --from ./scan-data \
  --filter 'licenses.contains_license("GPL")' \
  --report-json license-violations.json

# SARIF for GitHub Security tab
vet scan -D . --report-sarif=report.sarif

# JSON for custom tooling
vet scan -D . --report-json=report.json

# CSV for spreadsheet analysis
vet scan -D . --report-csv=report.csv

# HTML for web-based analysis
vet scan -D . --report-html=report.html

# Markdown reports for PRs
vet scan -D . --report-markdown=report.md

# Console summary (default)
vet scan -D . --report-summary

# SBOM generation
vet scan -D . --report-cdx=sbom.json

# Dependency graphs
vet scan -D . --report-graph=dependencies.dot

# Multi-format output
vet scan -D . \
  --report-json=report.json \
  --report-sarif=report.sarif \
  --report-markdown=report.md \
  --report-html=report.html

# Focus on specific issues
vet scan -D . \
  --filter 'vulns.high.exists(p, true)' \
  --report-json=report.json

# Start the MCP server with SSE transport
vet server mcp --server-type sse

# One-time setup
vet cloud quickstart

# Enable malware scanning
vet scan -D . --malware

# Query for known malicious packages without API key
vet scan -D . --malware-query

# Real-time scanning
vet scan -D . --malware

# Timeout adjustment
vet scan -D . --malware \
  --malware-analysis-timeout=300s

# Batch analysis
vet scan -D . --malware \
  --json-dump-dir=./analysis

# VS Code extensions
vet scan --vsx --malware

# GitHub Actions
vet scan -D .github/workflows --malware

# Container Images
vet scan --image nats:2.10 --malware

# Scan a single package and fail if its malicious
vet scan --purl pkg:/npm/nyc-config@10.0.0 --fail-fast

# Active scanning of a single package (requires API key)
vet inspect malware \
  --purl pkg:npm/nyc-config@10.0.0

# Disable telemetry (optional)
export VET_DISABLE_TELEMETRY=true