> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Vet FAQ

> Frequently asked questions about using Vet and troubleshooting common issues

## General Usage

### How do I disable the banner?

```bash theme={null}
export VET_DISABLE_BANNER=1
```

### Something is wrong! How do I debug this?

Enable debug logging:

<Tabs>
  <Tab title="Log to stdout">
    ```bash theme={null}
    vet scan -D /path/to/repo -l- -d
    ```
  </Tab>

  <Tab title="Log to file">
    ```bash theme={null}
    vet scan -D /path/to/repo -l /tmp/vet.log -d
    ```
  </Tab>

  <Tab title="Verbose output">
    ```bash theme={null}
    vet scan -D /path/to/repo -l- -v
    ```
  </Tab>
</Tabs>

## Installation and Setup

### Which version of Vet should I use?

Always use the latest stable version available:

```bash theme={null}
# Check current version
vet version

# Update via Homebrew (macOS/Linux)
brew upgrade safedep/tap/vet

# Or download latest from GitHub releases
# https://github.com/safedep/vet/releases
```

### Does Vet work offline?

Vet requires internet connectivity to:

* Download vulnerability data from OSV database
* Fetch OpenSSF Scorecard information
* Access package registry metadata
* Communicate with SafeDep Cloud (if using cloud features)

For offline environments, consider using the [JSON dump workflow](/reference/build-your-own-queries) to cache data locally.

### What package managers does Vet support?

Vet supports:

<AccordionGroup>
  <Accordion title="JavaScript/Node.js">
    * package-lock.json (npm)
    * yarn.lock (Yarn)
    * pnpm-lock.yaml (pnpm)
  </Accordion>

  <Accordion title="Python">
    * requirements.txt
    * Pipfile.lock (Pipenv)
    * poetry.lock (Poetry)
    * pyproject.toml
  </Accordion>

  <Accordion title="Java/JVM">
    * pom.xml (Maven)
    * build.gradle (Gradle)
    * gradle.lockfile
  </Accordion>

  <Accordion title="Go">
    * go.mod
    * go.sum
  </Accordion>

  <Accordion title="Other Languages">
    * Gemfile.lock (Ruby)
    * Cargo.lock (Rust)
    * composer.lock (PHP)
    * And many more...
  </Accordion>
</AccordionGroup>

## Scanning and Analysis

### Why is my scan taking so long?

Common causes:

<AccordionGroup>
  <Accordion title="Large dependency trees">
    Use path exclusions to skip irrelevant directories:

    ```bash theme={null}
    vet scan -D . --exclude 'node_modules/*' --exclude 'test/*'
    ```
  </Accordion>

  <Accordion title="Network latency">
    The scan fetches metadata from external sources. Slow internet can impact performance.
  </Accordion>

  <Accordion title="Malware analysis">
    Malware detection with `--malware-query` is a fast lookup against SafeDep's
    known malicious packages database and adds negligible overhead:

    ```bash theme={null}
    vet scan -D . --malware-query
    ```
  </Accordion>

  <Accordion title="First-time caching">
    Initial scans may be slower as Vet builds local caches.
  </Accordion>
</AccordionGroup>

### No vulnerabilities found - is this correct?

If Vet reports no vulnerabilities:

1. **Check the package versions** - Ensure you're scanning current dependency versions
2. **Verify manifest files** - Confirm Vet is finding and parsing your package manifests
3. **Check exclusions** - Make sure you haven't excluded relevant directories
4. **Review scan output** - Look for any warnings or errors during scanning

### How do I scan only specific files?

Use the `-M` flag to specify individual manifest files:

```bash theme={null}
# Single file
vet scan -M package-lock.json

# Multiple files
vet scan -M package-lock.json -M requirements.txt
```

## Policy and Filtering

### How do I create effective policies?

Start with a basic vulnerability check, then layer in additional conditions:

```bash theme={null}
--filter 'vulns.critical.size() > 0'
```

Test against known-good and known-bad packages before deploying. Enable warning-only mode first, then switch to blocking once the policy is stable. Add comments to policy files explaining the rationale for each rule.

### Why is my filter not working?

Common causes:

<AccordionGroup>
  <Accordion title="Syntax Errors">
    Verify CEL expression syntax:

    ```bash theme={null}
    # Correct
    vulns.critical.size() > 0

    # Incorrect
    vulns.critical.length() > 0  # Use size(), not length()
    ```
  </Accordion>

  <Accordion title="Data Structure">
    Check the [filter input specification](/reference/filtering) to understand available fields.
  </Accordion>

  <Accordion title="Boolean Logic">
    Ensure your expression evaluates to true/false:

    ```bash theme={null}
    # Returns boolean
    licenses.exists(p, p == "MIT")

    # Returns array (won't work as filter)
    licenses
    ```
  </Accordion>
</AccordionGroup>

## Performance and Optimization

### How can I speed up my scans?

<AccordionGroup>
  <Accordion title="Use Path Exclusions">
    Skip irrelevant directories:

    ```bash theme={null}
    vet scan -D . \
      --exclude 'test/*' \
      --exclude 'docs/*' \
      --exclude 'examples/*'
    ```
  </Accordion>

  <Accordion title="Scan Specific Manifests">
    Target only relevant package files:

    ```bash theme={null}
    vet scan -M package-lock.json -M requirements.txt
    ```
  </Accordion>

  <Accordion title="Use JSON Dump Workflow">
    Cache enriched data for repeated analysis:

    ```bash theme={null}
    vet scan -D . --json-dump-dir /tmp/cache
    vet query --from /tmp/cache --filter 'your-filter'
    ```
  </Accordion>

  <Accordion title="Parallel Processing">
    For multiple projects, run scans in parallel or use CI/CD matrix builds.
  </Accordion>
</AccordionGroup>

## CI/CD Integration

### My GitHub Action is failing - what should I check?

<AccordionGroup>
  <Accordion title="Action Version">
    Ensure you're using the latest version of vet-action:

    ```yaml theme={null}
    uses: safedep/vet-action@v1  # Use latest stable
    ```
  </Accordion>

  <Accordion title="Permissions">
    Check GitHub token permissions:

    ```yaml theme={null}
    permissions:
      contents: read
      security-events: write  # For SARIF upload
      pull-requests: write    # For PR comments
    ```
  </Accordion>

  <Accordion title="Secrets Configuration">
    Verify required secrets are set if using SafeDep Cloud:

    * `SAFEDEP_CLOUD_API_KEY`
    * `SAFEDEP_CLOUD_TENANT_DOMAIN`
  </Accordion>
</AccordionGroup>

### How do I handle false positives in CI?

<AccordionGroup>
  <Accordion title="Use Exceptions">
    Create an exceptions file for known false positives:

    ```yaml theme={null}
    - name: Run vet with exceptions
      uses: safedep/vet-action@v1
      with:
        exception-file: '.github/vet-exceptions.yml'
    ```
  </Accordion>

  <Accordion title="Adjust Policies">
    Refine your filter expressions to reduce noise:

    ```bash theme={null}
    # Be more specific about severity
    --filter 'vulns.critical.size() > 0'
    # Instead of
    --filter 'vulns.all.size() > 0'
    ```
  </Accordion>

  <Accordion title="Use Warning Mode">
    The action does not fail the build by default, so you can surface findings without blocking while you tune policies. Just leave `paranoid` off (its default is `false`):

    ```yaml theme={null}
    with:
      paranoid: false
    ```
  </Accordion>
</AccordionGroup>

## Data and Privacy

### What data does Vet collect?

Vet collects:

* **Package metadata** from public registries
* **Vulnerability data** from public databases (OSV, NVD)
* **OpenSSF Scorecard** metrics from public repositories

Only **package coordinates** (ecosystem, name, version) leave your machine. Your source code is never transmitted.

### Does Vet send my code anywhere?

No. Vet reads your manifests, lockfiles, and (when [code analysis](/governance/vet/code-analysis) is enabled) your source code **locally** to identify and trace dependencies. Only package coordinates are sent to SafeDep for vulnerability and malware analysis; your source code never leaves your machine.

### Can I use Vet in air-gapped environments?

Vet requires internet access for vulnerability data and package metadata. For air-gapped environments:

1. **Pre-cache data** using the [JSON dump workflow](/reference/build-your-own-queries)
2. **Use proxy servers** to control external access
3. **Consider enterprise solutions** for offline vulnerability databases

## Troubleshooting

### Common error messages and solutions

<AccordionGroup>
  <Accordion title="'No manifest files found'">
    * Check that you're in the correct directory
    * Verify manifest files exist (package-lock.json, requirements.txt, etc.)
    * Use `-M` flag to specify files explicitly
  </Accordion>

  <Accordion title="'Failed to download vulnerability data'">
    * Check internet connectivity
    * Verify firewall/proxy settings
    * Try again later (service might be temporarily unavailable)
  </Accordion>

  <Accordion title="'Memory limit exceeded'">
    * Use path exclusions to reduce scope
    * Scan smaller directory trees
    * Increase available memory in CI/CD
  </Accordion>

  <Accordion title="'Invalid filter expression'">
    * Check CEL syntax
    * Verify field names in filter input spec
    * Test expressions incrementally
  </Accordion>
</AccordionGroup>

## Getting More Help

<CardGroup cols={2}>
  <Card title="Community Discord" icon="discord" href="https://discord.gg/kAGEj25dCn">
    Real-time help and discussions
  </Card>

  <Card title="GitHub Issues" icon="github" href="https://github.com/safedep/vet/issues">
    Report bugs or search existing issues
  </Card>

  <Card title="Documentation" icon="book" href="/introduction">
    Guides and API reference
  </Card>

  <Card title="Email Support" icon="envelope" href="mailto:support@safedep.io">
    Direct support for complex issues
  </Card>
</CardGroup>

***

Can't find your question here? Check our [community page](/community) for more ways to get help!