Vulnerability auditor

Evaluates vulnerability records against vulnerability policy.

User notes

Needs --enrich because it evaluates vulnerability records that matchers attach to packages.

What the vulnerability auditor does

It walks every package in the resolved graph, reads the vulnerability records that matchers attached during enrichment, and turns each one into a finding when it matches policy. It does not fetch anything itself.

A finding is produced for every advisory on a package unless its ID is in the allowlist. Whether a finding fails the build is decided separately by --fail-on (see AUDITORS.md).

Options

Examples

# Fail CI on any high-or-critical vulnerability
bomly scan --enrich --audit --fail-on high

# Same gate, but accept one advisory you've assessed as not exploitable
bomly scan --enrich --audit --fail-on high \
  --allow-vulnerability-id GHSA-xxxx-yyyy-zzzz

# Only fail when a high-severity advisory is also reachable
bomly scan --enrich --audit --analyze \
  --fail-on high --fail-on reachable

# Only fail when a high-severity advisory has known exploitation evidence
bomly scan --enrich --audit \
  --fail-on high --fail-on exploitable

Limitations

• Garbage in, garbage out. The auditor is only as good as the matcher data. Run --enrich (or ingest an SBOM with advisories) or it will find nothing.
• Allowlisting is by ID, not by package. --allow-vulnerability-id suppresses an advisory everywhere it appears, across every package.
• Reachability is experimental. --fail-on reachable depends on --analyze; an unknown reachability status does not mean "safe." See REACHABILITY.md.
• Exploitability depends on enrichment evidence. --fail-on exploitable matches a positive known-exploitation signal; absence of that signal does not prove an advisory is unexploitable.