Tags

Tags provide a flexible, team-defined taxonomy for categorizing and scoping vulnerability entries. They can represent customer-facing deliverables (binary, container, sdk), internal usage contexts (build-dep, test-infra), or any other categorization.

Defining tags

Tags are defined in the optional tags section of a Vulnlog file.

Field Type Required Description

id

String

Yes

Unique identifier for the tag. Referenced by vulnerability entries and release purl entries.

description

String

No

Human-readable description of what this tag represents.

 
tags:
  - id: binary
    description: Shipped as native binary
  - id: container
    description: Shipped as Docker container
  - id: build-dep
    description: Build-time dependency only

Assigning tags

Tags can be assigned in two places:

On vulnerability entries

Tags on a vulnerability entry categorize the finding, enable CLI filtering, and name the release artifacts a VEX statement covers.

vulnerabilities:
  - id: CVE-2026-5678
    releases: [ 2.0.0 ]
    packages: [ "pkg:npm/image-lib@3.1.0" ]
    reports:
      - reporter: trivy
    tags: [ container ]

On release PURLs

Tags on release purl entries enable scoped output generation. A VEX statement names only the release purls that share a tag with the entry, see Declare and tag release purls.

releases:
  - id: 8.1.1
    purls:
      - purl: pkg:generic/demo-project@8.1.1
        tags: [ binary ]
      - purl: pkg:docker/demo-project@8.1.1
        tags: [ container ]

Filtering by tags

Use the --tag flag to filter CLI output by tag. The flag is repeatable to filter on multiple tags. This flag is available on the report, suppress and vex openvex commands.

vulnlog suppress my-app.vl.yaml --reporter trivy --tag container
vulnlog report impact my-app.vl.yaml --tag build-dep

Defaults

Vulnerability entries without tags are included in all unfiltered outputs, except VEX documents: an untagged entry names no release artifact.