FAQ
Frequently asked questions about using vet and troubleshooting common issues
Common questions and troubleshooting tips for using vet effectively.
General Usage
How do I disable the banner?
Set the environment variable to disable the vet banner:
Something is wrong! How do I debug this?
Run vet with debug logging enabled to diagnose issues:
Installation and Setup
Which version of vet should I use?
Always use the latest stable version available:
Does vet work offline?
vet requires internet connectivity to:
- Download vulnerability data from OSV database
- Fetch OpenSSF Scorecard information
- Access package registry metadata
- Communicate with SafeDep Cloud (if using cloud features)
For offline environments, consider using the JSON dump workflow to cache data locally.
What package managers does vet support?
vet supports a wide range of package managers:
JavaScript/Node.js
JavaScript/Node.js
- package-lock.json (npm)
- yarn.lock (Yarn)
- pnpm-lock.yaml (pnpm)
Python
Python
- requirements.txt
- Pipfile.lock (Pipenv)
- poetry.lock (Poetry)
- pyproject.toml
Java/JVM
Java/JVM
- pom.xml (Maven)
- build.gradle (Gradle)
- gradle.lockfile
Go
Go
- go.mod
- go.sum
Other Languages
Other Languages
- Gemfile.lock (Ruby)
- Cargo.lock (Rust)
- composer.lock (PHP)
- And many more…
Scanning and Analysis
Why is my scan taking so long?
Several factors can affect scan performance:
Large dependency trees
Large dependency trees
Use path exclusions to skip irrelevant directories:
Network latency
Network latency
The scan fetches metadata from external sources. Slow internet can impact performance.
Malware analysis
Malware analysis
If using --malware, adjust the timeout:
First-time caching
First-time caching
Initial scans may be slower as vet builds local caches.
No vulnerabilities found - is this correct?
If vet reports no vulnerabilities:
- Check the package versions - Ensure you’re scanning current dependency versions
- Verify manifest files - Confirm vet is finding and parsing your package manifests
- Check exclusions - Make sure you haven’t excluded relevant directories
- Review scan output - Look for any warnings or errors during scanning
How do I scan only specific files?
Use the -M flag to specify individual manifest files:
Policy and Filtering
How do I create effective policies?
Follow these best practices for policy creation:
Start Simple
Start Simple
Begin with basic vulnerability checks:
Test Thoroughly
Test Thoroughly
Test policies against known good and bad packages before deploying.
Use Gradual Rollout
Use Gradual Rollout
Start with warning-only mode before enforcing blocking policies.
Document Decisions
Document Decisions
Include comments in policy files explaining the rationale for each rule.
Why is my filter not working?
Common filter issues and solutions:
Syntax Errors
Syntax Errors
Verify CEL expression syntax:
Data Structure
Data Structure
Check the filter input specification to understand available fields.
Boolean Logic
Boolean Logic
Ensure your expression evaluates to true/false:
Performance and Optimization
How can I speed up my scans?
Use Path Exclusions
Use Path Exclusions
Skip irrelevant directories:
Scan Specific Manifests
Scan Specific Manifests
Target only relevant package files:
Use JSON Dump Workflow
Use JSON Dump Workflow
Cache enriched data for repeated analysis:
Parallel Processing
Parallel Processing
For multiple projects, run scans in parallel or use CI/CD matrix builds.
CI/CD Integration
My GitHub Action is failing - what should I check?
Action Version
Action Version
Ensure you’re using the latest version of vet-action:
Permissions
Permissions
Check GitHub token permissions:
Secrets Configuration
Secrets Configuration
Verify required secrets are set if using SafeDep Cloud:
SAFEDEP_CLOUD_API_KEYSAFEDEP_CLOUD_TENANT_DOMAIN
How do I handle false positives in CI?
Use Exceptions
Use Exceptions
Create an exceptions file for known false positives:
Adjust Policies
Adjust Policies
Refine your filter expressions to reduce noise:
Use Warning Mode
Use Warning Mode
Don’t fail builds while tuning policies:
Data and Privacy
What data does vet collect?
vet collects:
- Package metadata from public registries
- Vulnerability data from public databases (OSV, NVD)
- OpenSSF Scorecard metrics from public repositories
- No source code is ever analyzed or transmitted
Does vet send my code anywhere?
No. vet only analyzes package manifest files (like package-lock.json) and does not access or transmit your source code. All analysis is based on publicly available package metadata.
Can I use vet in air-gapped environments?
vet requires internet access for vulnerability data and package metadata. For air-gapped environments:
- Pre-cache data using the JSON dump workflow
- Use proxy servers to control external access
- Consider enterprise solutions for offline vulnerability databases
Troubleshooting
Common error messages and solutions
'No manifest files found'
'No manifest files found'
- Check that you’re in the correct directory
- Verify manifest files exist (package-lock.json, requirements.txt, etc.)
- Use
-Mflag to specify files explicitly
'Failed to download vulnerability data'
'Failed to download vulnerability data'
- Check internet connectivity
- Verify firewall/proxy settings
- Try again later (service might be temporarily unavailable)
'Memory limit exceeded'
'Memory limit exceeded'
- Use path exclusions to reduce scope
- Scan smaller directory trees
- Increase available memory in CI/CD
'Invalid filter expression'
'Invalid filter expression'
- Check CEL syntax
- Verify field names in filter input spec
- Test expressions incrementally
Getting More Help
Community Discord
Join our community for real-time help and discussions
GitHub Issues
Report bugs or search existing issues
Documentation
Comprehensive guides and API reference
Email Support
Direct support for complex issues
Can’t find your question here? Check our community page for more ways to get help!
FAQ
Frequently asked questions about using vet and troubleshooting common issues
Common questions and troubleshooting tips for using vet effectively.
General Usage
How do I disable the banner?
Set the environment variable to disable the vet banner:
Something is wrong! How do I debug this?
Run vet with debug logging enabled to diagnose issues:
Installation and Setup
Which version of vet should I use?
Always use the latest stable version available:
Does vet work offline?
vet requires internet connectivity to:
- Download vulnerability data from OSV database
- Fetch OpenSSF Scorecard information
- Access package registry metadata
- Communicate with SafeDep Cloud (if using cloud features)
For offline environments, consider using the JSON dump workflow to cache data locally.
What package managers does vet support?
vet supports a wide range of package managers:
JavaScript/Node.js
JavaScript/Node.js
- package-lock.json (npm)
- yarn.lock (Yarn)
- pnpm-lock.yaml (pnpm)
Python
Python
- requirements.txt
- Pipfile.lock (Pipenv)
- poetry.lock (Poetry)
- pyproject.toml
Java/JVM
Java/JVM
- pom.xml (Maven)
- build.gradle (Gradle)
- gradle.lockfile
Go
Go
- go.mod
- go.sum
Other Languages
Other Languages
- Gemfile.lock (Ruby)
- Cargo.lock (Rust)
- composer.lock (PHP)
- And many more…
Scanning and Analysis
Why is my scan taking so long?
Several factors can affect scan performance:
Large dependency trees
Large dependency trees
Use path exclusions to skip irrelevant directories:
Network latency
Network latency
The scan fetches metadata from external sources. Slow internet can impact performance.
Malware analysis
Malware analysis
If using --malware, adjust the timeout:
First-time caching
First-time caching
Initial scans may be slower as vet builds local caches.
No vulnerabilities found - is this correct?
If vet reports no vulnerabilities:
- Check the package versions - Ensure you’re scanning current dependency versions
- Verify manifest files - Confirm vet is finding and parsing your package manifests
- Check exclusions - Make sure you haven’t excluded relevant directories
- Review scan output - Look for any warnings or errors during scanning
How do I scan only specific files?
Use the -M flag to specify individual manifest files:
Policy and Filtering
How do I create effective policies?
Follow these best practices for policy creation:
Start Simple
Start Simple
Begin with basic vulnerability checks:
Test Thoroughly
Test Thoroughly
Test policies against known good and bad packages before deploying.
Use Gradual Rollout
Use Gradual Rollout
Start with warning-only mode before enforcing blocking policies.
Document Decisions
Document Decisions
Include comments in policy files explaining the rationale for each rule.
Why is my filter not working?
Common filter issues and solutions:
Syntax Errors
Syntax Errors
Verify CEL expression syntax:
Data Structure
Data Structure
Check the filter input specification to understand available fields.
Boolean Logic
Boolean Logic
Ensure your expression evaluates to true/false:
Performance and Optimization
How can I speed up my scans?
Use Path Exclusions
Use Path Exclusions
Skip irrelevant directories:
Scan Specific Manifests
Scan Specific Manifests
Target only relevant package files:
Use JSON Dump Workflow
Use JSON Dump Workflow
Cache enriched data for repeated analysis:
Parallel Processing
Parallel Processing
For multiple projects, run scans in parallel or use CI/CD matrix builds.
CI/CD Integration
My GitHub Action is failing - what should I check?
Action Version
Action Version
Ensure you’re using the latest version of vet-action:
Permissions
Permissions
Check GitHub token permissions:
Secrets Configuration
Secrets Configuration
Verify required secrets are set if using SafeDep Cloud:
SAFEDEP_CLOUD_API_KEYSAFEDEP_CLOUD_TENANT_DOMAIN
How do I handle false positives in CI?
Use Exceptions
Use Exceptions
Create an exceptions file for known false positives:
Adjust Policies
Adjust Policies
Refine your filter expressions to reduce noise:
Use Warning Mode
Use Warning Mode
Don’t fail builds while tuning policies:
Data and Privacy
What data does vet collect?
vet collects:
- Package metadata from public registries
- Vulnerability data from public databases (OSV, NVD)
- OpenSSF Scorecard metrics from public repositories
- No source code is ever analyzed or transmitted
Does vet send my code anywhere?
No. vet only analyzes package manifest files (like package-lock.json) and does not access or transmit your source code. All analysis is based on publicly available package metadata.
Can I use vet in air-gapped environments?
vet requires internet access for vulnerability data and package metadata. For air-gapped environments:
- Pre-cache data using the JSON dump workflow
- Use proxy servers to control external access
- Consider enterprise solutions for offline vulnerability databases
Troubleshooting
Common error messages and solutions
'No manifest files found'
'No manifest files found'
- Check that you’re in the correct directory
- Verify manifest files exist (package-lock.json, requirements.txt, etc.)
- Use
-Mflag to specify files explicitly
'Failed to download vulnerability data'
'Failed to download vulnerability data'
- Check internet connectivity
- Verify firewall/proxy settings
- Try again later (service might be temporarily unavailable)
'Memory limit exceeded'
'Memory limit exceeded'
- Use path exclusions to reduce scope
- Scan smaller directory trees
- Increase available memory in CI/CD
'Invalid filter expression'
'Invalid filter expression'
- Check CEL syntax
- Verify field names in filter input spec
- Test expressions incrementally
Getting More Help
Community Discord
Join our community for real-time help and discussions
GitHub Issues
Report bugs or search existing issues
Documentation
Comprehensive guides and API reference
Email Support
Direct support for complex issues
Can’t find your question here? Check our community page for more ways to get help!