> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Vet FAQ

> Frequently asked questions about using Vet and troubleshooting common issues

## General Usage

### How do I disable the banner?

```bash theme={null}
export VET_DISABLE_BANNER=1
```

### Something is wrong! How do I debug this?

Enable debug logging:

> [tab] Log to stdout
>
> ```bash theme={null}
> vet scan -D /path/to/repo -l- -d
> ```

> [tab] Log to file
>
> ```bash theme={null}
> vet scan -D /path/to/repo -l /tmp/vet.log -d
> ```

> [tab] Verbose output
>
> ```bash theme={null}
> vet scan -D /path/to/repo -l- -v
> ```

## Installation and Setup

### Which version of Vet should I use?

Always use the latest stable version available:

```bash theme={null}
# Check current version
vet version

# Update via Homebrew (macOS/Linux)
brew upgrade safedep/tap/vet

# Or download latest from GitHub releases
# https://github.com/safedep/vet/releases
```

### Does Vet work offline?

Vet requires internet connectivity to:

* Download vulnerability data from OSV database
* Fetch OpenSSF Scorecard information
* Access package registry metadata
* Communicate with SafeDep Cloud (if using cloud features)

For offline environments, consider using the [JSON dump workflow](https://docs.safedep.io/governance/vet/build-your-own-queries.md) to cache data locally.

### What package managers does Vet support?

Vet supports:

> [accordion] JavaScript/Node.js
>
> * package-lock.json (npm)
> * yarn.lock (Yarn)
> * pnpm-lock.yaml (pnpm)

> [accordion] Python
>
> * requirements.txt
> * Pipfile.lock (Pipenv)
> * poetry.lock (Poetry)
> * pyproject.toml

> [accordion] Java/JVM
>
> * pom.xml (Maven)
> * build.gradle (Gradle)
> * gradle.lockfile

> [accordion] Go
>
> * go.mod
> * go.sum

> [accordion] Other Languages
>
> * Gemfile.lock (Ruby)
> * Cargo.lock (Rust)
> * composer.lock (PHP)
> * And many more...

## Scanning and Analysis

### Why is my scan taking so long?

Common causes:

> [accordion] Large dependency trees
>
> Use path exclusions to skip irrelevant directories:
>
> ```bash theme={null}
> vet scan -D . --exclude 'node_modules/*' --exclude 'test/*'
> ```

> [accordion] Network latency
>
> The scan fetches metadata from external sources. Slow internet can impact performance.

> [accordion] Malware analysis
>
> Malware detection with `--malware-query` is a fast lookup against SafeDep's
> known malicious packages database and adds negligible overhead:
>
> ```bash theme={null}
> vet scan -D . --malware-query
> ```

> [accordion] First-time caching
>
> Initial scans may be slower as Vet builds local caches.

### No vulnerabilities found - is this correct?

If Vet reports no vulnerabilities:

1. **Check the package versions** - Ensure you're scanning current dependency versions
2. **Verify manifest files** - Confirm Vet is finding and parsing your package manifests
3. **Check exclusions** - Make sure you haven't excluded relevant directories
4. **Review scan output** - Look for any warnings or errors during scanning

### How do I scan only specific files?

Use the `-M` flag to specify individual manifest files:

```bash theme={null}
# Single file
vet scan -M package-lock.json

# Multiple files
vet scan -M package-lock.json -M requirements.txt
```

## Policy and Filtering

### How do I create effective policies?

Start with a basic vulnerability check, then layer in additional conditions:

```bash theme={null}
--filter 'vulns.critical.size() > 0'
```

Test against known-good and known-bad packages before deploying. Enable warning-only mode first, then switch to blocking once the policy is stable. Add comments to policy files explaining the rationale for each rule.

### Why is my filter not working?

Common causes:

> [accordion] Syntax Errors
>
> Verify CEL expression syntax:
>
> ```bash theme={null}
> # Correct
> vulns.critical.size() > 0
>
> # Incorrect
> vulns.critical.length() > 0  # Use size(), not length()
> ```

> [accordion] Data Structure
>
> Check the [filter input specification](https://docs.safedep.io/reference/filtering.md) to understand available fields.

> [accordion] Boolean Logic
>
> Ensure your expression evaluates to true/false:
>
> ```bash theme={null}
> # Returns boolean
> licenses.exists(p, p == "MIT")
>
> # Returns array (won't work as filter)
> licenses
> ```

## Performance and Optimization

### How can I speed up my scans?

> [accordion] Use Path Exclusions
>
> Skip irrelevant directories:
>
> ```bash theme={null}
> vet scan -D . \
>   --exclude 'test/*' \
>   --exclude 'docs/*' \
>   --exclude 'examples/*'
> ```

> [accordion] Scan Specific Manifests
>
> Target only relevant package files:
>
> ```bash theme={null}
> vet scan -M package-lock.json -M requirements.txt
> ```

> [accordion] Use JSON Dump Workflow
>
> Cache enriched data for repeated analysis:
>
> ```bash theme={null}
> vet scan -D . --json-dump-dir /tmp/cache
> vet query --from /tmp/cache --filter 'your-filter'
> ```

> [accordion] Parallel Processing
>
> For multiple projects, run scans in parallel or use CI/CD matrix builds.

## CI/CD Integration

### My GitHub Action is failing - what should I check?

> [accordion] Action Version
>
> Ensure you're using the latest version of vet-action:
>
> ```yaml theme={null}
> uses: safedep/vet-action@v1  # Use latest stable
> ```

> [accordion] Permissions
>
> Check GitHub token permissions:
>
> ```yaml theme={null}
> permissions:
>   contents: read
>   security-events: write  # For SARIF upload
>   pull-requests: write    # For PR comments
> ```

> [accordion] Secrets Configuration
>
> Verify required secrets are set if using SafeDep Cloud:
>
> * `SAFEDEP_CLOUD_API_KEY`
> * `SAFEDEP_CLOUD_TENANT_DOMAIN`

### How do I handle false positives in CI?

> [accordion] Use Exceptions
>
> Create an exceptions file for known false positives:
>
> ```yaml theme={null}
> - name: Run vet with exceptions
>   uses: safedep/vet-action@v1
>   with:
>     exception-file: '.github/vet-exceptions.yml'
> ```

> [accordion] Adjust Policies
>
> Refine your filter expressions to reduce noise:
>
> ```bash theme={null}
> # Be more specific about severity
> --filter 'vulns.critical.size() > 0'
> # Instead of
> --filter 'vulns.all.size() > 0'
> ```

> [accordion] Use Warning Mode
>
> The action does not fail the build by default, so you can surface findings without blocking while you tune policies. Just leave `paranoid` off (its default is `false`):
>
> ```yaml theme={null}
> with:
>   paranoid: false
> ```

## Data and Privacy

### What data does Vet collect?

Vet collects:

* **Package metadata** from public registries
* **Vulnerability data** from public databases (OSV, NVD)
* **OpenSSF Scorecard** metrics from public repositories

Only **package coordinates** (ecosystem, name, version) leave your machine. Your source code is never transmitted.

### Does Vet send my code anywhere?

No. Vet reads your manifests, lockfiles, and (when [code analysis](https://docs.safedep.io/governance/vet/code-analysis.md) is enabled) your source code **locally** to identify and trace dependencies. Only package coordinates are sent to SafeDep for vulnerability and malware analysis; your source code never leaves your machine.

### Can I use Vet in air-gapped environments?

Vet requires internet access for vulnerability data and package metadata. For air-gapped environments:

1. **Pre-cache data** using the [JSON dump workflow](https://docs.safedep.io/governance/vet/build-your-own-queries.md)
2. **Use proxy servers** to control external access
3. **Consider enterprise solutions** for offline vulnerability databases

## Troubleshooting

### Common error messages and solutions

> [accordion] 'No manifest files found'
>
> * Check that you're in the correct directory
> * Verify manifest files exist (package-lock.json, requirements.txt, etc.)
> * Use `-M` flag to specify files explicitly

> [accordion] 'Failed to download vulnerability data'
>
> * Check internet connectivity
> * Verify firewall/proxy settings
> * Try again later (service might be temporarily unavailable)

> [accordion] 'Memory limit exceeded'
>
> * Use path exclusions to reduce scope
> * Scan smaller directory trees
> * Increase available memory in CI/CD

> [accordion] 'Invalid filter expression'
>
> * Check CEL syntax
> * Verify field names in filter input spec
> * Test expressions incrementally

## Getting More Help

> [card] [Community Discord](https://discord.gg/kAGEj25dCn)
>
> Real-time help and discussions

> [card] [GitHub Issues](https://github.com/safedep/vet/issues)
>
> Report bugs or search existing issues

> [card] [Documentation](https://docs.safedep.io/introduction.md)
>
> Guides and API reference

> [card] [Email Support](mailto:support@safedep.io)
>
> Direct support for complex issues

***

Can't find your question here? Check our [community page](https://docs.safedep.io/community.md) for more ways to get help!


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.