SafeDep Documentation

General Usage

export VET_DISABLE_BANNER=1

Something is wrong! How do I debug this?

Enable debug logging:

Log to stdout
Log to file
Verbose output

vet scan -D /path/to/repo -l- -d

vet scan -D /path/to/repo -l /tmp/vet.log -d

vet scan -D /path/to/repo -l- -v

Installation and Setup

Which version of Vet should I use?

Always use the latest stable version available:

# Check current version
vet version

# Update via Homebrew (macOS/Linux)
brew upgrade safedep/tap/vet

# Or download latest from GitHub releases
# https://github.com/safedep/vet/releases

Does Vet work offline?

Vet requires internet connectivity to:

Download vulnerability data from OSV database
Fetch OpenSSF Scorecard information
Access package registry metadata
Communicate with SafeDep Cloud (if using cloud features)

For offline environments, consider using the JSON dump workflow to cache data locally.

What package managers does Vet support?

Vet supports:

JavaScript/Node.js

package-lock.json (npm)
yarn.lock (Yarn)
pnpm-lock.yaml (pnpm)

Python

requirements.txt
Pipfile.lock (Pipenv)
poetry.lock (Poetry)
pyproject.toml

Java/JVM

pom.xml (Maven)
build.gradle (Gradle)
gradle.lockfile

go.mod
go.sum

Other Languages

Gemfile.lock (Ruby)
Cargo.lock (Rust)
composer.lock (PHP)
And many more…

Scanning and Analysis

Why is my scan taking so long?

Common causes:

Large dependency trees

Use path exclusions to skip irrelevant directories:

vet scan -D . --exclude 'node_modules/*' --exclude 'test/*'

Network latency

The scan fetches metadata from external sources. Slow internet can impact performance.

Malware analysis

Malware detection with --malware-query is a fast lookup against SafeDep’s known malicious packages database and adds negligible overhead:

vet scan -D . --malware-query

First-time caching

Initial scans may be slower as Vet builds local caches.

No vulnerabilities found - is this correct?

If Vet reports no vulnerabilities:

Check the package versions - Ensure you’re scanning current dependency versions
Verify manifest files - Confirm Vet is finding and parsing your package manifests
Check exclusions - Make sure you haven’t excluded relevant directories
Review scan output - Look for any warnings or errors during scanning

How do I scan only specific files?

Use the -M flag to specify individual manifest files:

# Single file
vet scan -M package-lock.json

# Multiple files
vet scan -M package-lock.json -M requirements.txt

Policy and Filtering

How do I create effective policies?

Start with a basic vulnerability check, then layer in additional conditions:

--filter 'vulns.critical.size() > 0'

Test against known-good and known-bad packages before deploying. Enable warning-only mode first, then switch to blocking once the policy is stable. Add comments to policy files explaining the rationale for each rule.

Why is my filter not working?

Common causes:

Syntax Errors

Verify CEL expression syntax:

# Correct
vulns.critical.size() > 0

# Incorrect
vulns.critical.length() > 0  # Use size(), not length()

Data Structure

Check the filter input specification to understand available fields.

Boolean Logic

Ensure your expression evaluates to true/false:

# Returns boolean
licenses.exists(p, p == "MIT")

# Returns array (won't work as filter)
licenses

Performance and Optimization

How can I speed up my scans?

Use Path Exclusions

Skip irrelevant directories:

vet scan -D . \
  --exclude 'test/*' \
  --exclude 'docs/*' \
  --exclude 'examples/*'

Scan Specific Manifests

Target only relevant package files:

vet scan -M package-lock.json -M requirements.txt

Use JSON Dump Workflow

Cache enriched data for repeated analysis:

vet scan -D . --json-dump-dir /tmp/cache
vet query --from /tmp/cache --filter 'your-filter'

Parallel Processing

For multiple projects, run scans in parallel or use CI/CD matrix builds.

CI/CD Integration

My GitHub Action is failing - what should I check?

Action Version

Ensure you’re using the latest version of vet-action:

uses: safedep/vet-action@v1  # Use latest stable

Permissions

Check GitHub token permissions:

permissions:
  contents: read
  security-events: write  # For SARIF upload
  pull-requests: write    # For PR comments

Secrets Configuration

Verify required secrets are set if using SafeDep Cloud:

SAFEDEP_CLOUD_API_KEY
SAFEDEP_CLOUD_TENANT_DOMAIN

How do I handle false positives in CI?

Use Exceptions

Create an exceptions file for known false positives:

- name: Run vet with exceptions
  uses: safedep/vet-action@v1
  with:
    exception-file: '.github/vet-exceptions.yml'

Adjust Policies

Refine your filter expressions to reduce noise:

# Be more specific about severity
--filter 'vulns.critical.size() > 0'
# Instead of
--filter 'vulns.all.size() > 0'

Use Warning Mode

The action does not fail the build by default, so you can surface findings without blocking while you tune policies. Just leave paranoid off (its default is false):

with:
  paranoid: false

Data and Privacy

What data does Vet collect?

Vet collects:

Package metadata from public registries
Vulnerability data from public databases (OSV, NVD)
OpenSSF Scorecard metrics from public repositories

Only package coordinates (ecosystem, name, version) leave your machine. Your source code is never transmitted.

Does Vet send my code anywhere?

No. Vet reads your manifests, lockfiles, and (when code analysis is enabled) your source code locally to identify and trace dependencies. Only package coordinates are sent to SafeDep for vulnerability and malware analysis; your source code never leaves your machine.

Can I use Vet in air-gapped environments?

Vet requires internet access for vulnerability data and package metadata. For air-gapped environments:

Pre-cache data using the JSON dump workflow
Use proxy servers to control external access
Consider enterprise solutions for offline vulnerability databases

Troubleshooting

Common error messages and solutions

'No manifest files found'

Check that you’re in the correct directory
Verify manifest files exist (package-lock.json, requirements.txt, etc.)
Use -M flag to specify files explicitly

'Failed to download vulnerability data'

Check internet connectivity
Verify firewall/proxy settings
Try again later (service might be temporarily unavailable)

'Memory limit exceeded'

Use path exclusions to reduce scope
Scan smaller directory trees
Increase available memory in CI/CD

'Invalid filter expression'

Check CEL syntax
Verify field names in filter input spec
Test expressions incrementally

Getting More Help

Community Discord

Real-time help and discussions

GitHub Issues

Report bugs or search existing issues

Documentation

Guides and API reference

Email Support

Direct support for complex issues

Can’t find your question here? Check our community page for more ways to get help!

Community

Support

Vet FAQ

General Usage

How do I disable the banner?

Something is wrong! How do I debug this?

Installation and Setup

Which version of Vet should I use?

Does Vet work offline?

What package managers does Vet support?

Scanning and Analysis

Why is my scan taking so long?

No vulnerabilities found - is this correct?

How do I scan only specific files?

Policy and Filtering

How do I create effective policies?

Why is my filter not working?

Performance and Optimization

How can I speed up my scans?

CI/CD Integration

My GitHub Action is failing - what should I check?

How do I handle false positives in CI?

Data and Privacy

What data does Vet collect?

Does Vet send my code anywhere?

Can I use Vet in air-gapped environments?

Troubleshooting

Common error messages and solutions

Getting More Help

Community Discord

GitHub Issues

Documentation

Email Support

​General Usage

​How do I disable the banner?

​Something is wrong! How do I debug this?

​Installation and Setup

​Which version of Vet should I use?

​Does Vet work offline?

​What package managers does Vet support?

​Scanning and Analysis

​Why is my scan taking so long?

​No vulnerabilities found - is this correct?

​How do I scan only specific files?

​Policy and Filtering

​How do I create effective policies?

​Why is my filter not working?

​Performance and Optimization

​How can I speed up my scans?

​CI/CD Integration

​My GitHub Action is failing - what should I check?

​How do I handle false positives in CI?

​Data and Privacy

​What data does Vet collect?

​Does Vet send my code anywhere?

​Can I use Vet in air-gapped environments?

​Troubleshooting

​Common error messages and solutions

​Getting More Help

Community Discord

GitHub Issues

Documentation

Email Support

General Usage

How do I disable the banner?

Something is wrong! How do I debug this?

Installation and Setup

Which version of Vet should I use?

Does Vet work offline?

What package managers does Vet support?

Scanning and Analysis

Why is my scan taking so long?

No vulnerabilities found - is this correct?

How do I scan only specific files?

Policy and Filtering

How do I create effective policies?

Why is my filter not working?

Performance and Optimization

How can I speed up my scans?

CI/CD Integration

My GitHub Action is failing - what should I check?

How do I handle false positives in CI?

Data and Privacy

What data does Vet collect?

Does Vet send my code anywhere?

Can I use Vet in air-gapped environments?

Troubleshooting

Common error messages and solutions

Getting More Help