What is Vulnlog?

Vulnlog is a developer-oriented approach to software supply chain security. It pairs a YAML file format with a CLI and a Gradle plugin that turn the file into software composition analysis (SCA) scanner ignore files and vulnerability reports. The CLI is designed to run in CI pipelines and on developer machines.

How Vulnlog works: scanner reports a finding, engineer analyses the impact, Vulnlog generates report and ignore files

Vulnlog is open source, hosted on GitHub and licensed under Apache 2.0. Contributions, bug reports, and feature requests are welcome.

The workflow

Vulnlog is designed around the SCA scanning process:

  1. An SCA scanner, for example Cargo Audit, Snyk, or Trivy, scans the project and reports one or more vulnerabilities.

  2. An engineer analyses each report, decides whether it affects the project, and records the analysis, verdict, and next steps in the Vulnlog YAML file.

    Vulnerability entry for CVE-2026-1234 that was reported by Trivy but does not affect the product.
      - id: CVE-2026-1234
    description: Remote code execution in example-lib
    releases: [1.0.0]
    packages: ["pkg:npm/example-lib@2.3.0"]
    reports:
      - reporter: trivy
    analysis: >-
      The vulnerable code path is not reachable in our application because we only use the safe subset of the API.
    verdict: not affected
    justification: vulnerable code not in execute path

  3. The Vulnlog CLI reads the YAML file, validates it, and generates reports, suppression files, or both.

How it compares to scanner ignore files

Scanner ignore files (.trivyignore, .snyk) and Vulnlog solve the same immediate problem: silencing findings that were reviewed. The difference is what survives the review. An ignore file keeps one line per finding and per scanner; the reasoning lives in a ticket, a chat thread, or nobody’s memory. A Vulnlog file keeps the analysis, the verdict, and the resolution with the finding, generates the ignore file for every scanner from it, and leaves the history to git.

Why decisions live in git covers the reasoning in full.

Next steps