The Vulnlog CLI

vulnlog <command> <file...> [flags]

Every command except init requires one or more Vulnlog files as positional arguments. Read-only commands like validate accept multiple files. report accepts multiple files; they are merged and must share the same project metadata. suppress operates on a single file. No automatic file detection.

Global flags

Flag Description

--version

Print version and exit.

--help

Print help.

-v, --verbose

Print diagnostic lines prefixed verbose: on stderr.

-vv

Additionally print debug: lines and full stack traces on unexpected errors.

-q, --quiet

Suppress status lines. Errors and warnings always print. Cannot be combined with -v.

Output messages

Message formats, color behavior, and exit codes are a stable interface, documented in Exit codes and messages.

Diagnostics

By default a command prints one status line per action, plus errors and warnings. -v adds diagnostic detail about what the tool did: one line per parsed input file, a validation summary per file, the releases and tags a filter expanded to, every written output file, and every entry excluded from an output with the reason. -vv adds debug detail aimed at bug reports: every entry included in a suppression file, the findings that caused a file to be reformatted, report entry counts before and after merging, and the full stack trace when an unexpected error occurs; without it, such errors show a single error: line.

Diagnostics always go to stderr. Stdout carries only command output, so redirections like vulnlog suppress --reporter trivy -o - > .trivyignore.yaml are safe at any verbosity. There is no log file; to capture diagnostics, redirect stderr.

Filtering flags

Available on report and suppress commands.

Flag Description

--release <id>

Include vulnerabilities affecting all releases up to and including this release.

--tag <id>

Filter by tag (repeatable).

--reporter <value>

Filter by reporter type.

Commands

Command Description

init

Scaffold a new Vulnlog file.

validate

Validate files against the schema and all validation rules.

fmt

Format files to the canonical style.

suppress

Generate scanner-specific suppression files.

report

Generate an HTML vulnerability report.

modify add

Add a new vulnerability entry to one or more Vulnlog files.

modify copy

Copy vulnerability entries from one Vulnlog file into one or more others.

Exit codes

Every command exits with one of the documented codes; the table lives in Exit codes and messages.