Vulnerability auditor

Evaluates the vulnerability records that matchers attached during --enrich against vulnerability policy.

What the vulnerability auditor does

It walks every package in the resolved graph, reads the vulnerability records that matchers attached during enrichment, and turns each one into a finding when it matches policy. It fetches nothing itself, so without --enrich or an SBOM that carries advisories it finds nothing.

Every advisory on a package becomes a finding unless its ID is on the allowlist. Whether a finding fails the build is decided separately by --fail-on; see AUDITORS.md.

Options

Examples

# Fail CI on any high or critical vulnerability
bomly scan --enrich --audit --fail-on high

# Same gate, but accept one advisory you assessed as not exploitable
bomly scan --enrich --audit --fail-on high \
  --allow-vulnerability-id GHSA-xxxx-yyyy-zzzz

# Fail only when a high-severity advisory is also reachable
bomly scan --enrich --audit --analyze \
  --fail-on high --fail-on reachable

# Fail only when a high-severity advisory has known exploitation evidence
bomly scan --enrich --audit \
  --fail-on high --fail-on exploitable

Limitations

• The auditor is only as good as the matcher data. A package whose lookup failed looks clean.
• Allowlisting is by ID, not by package. --allow-vulnerability-id suppresses an advisory everywhere it appears, across every package.
• Reachability is experimental. --fail-on reachable depends on --analyze, and an unknown reachability status does not mean safe. See Reachability.
• Exploitability depends on enrichment evidence. --fail-on exploitable matches a positive known-exploitation signal. The absence of that signal does not prove an advisory is unexploitable.