Vulnlog

Vulnlog records your team’s vulnerability triage decisions in a git-tracked YAML file and turns them into scanner suppression files and shareable reports. A decision is recorded once: the scanner stops flagging it, the report explains it, and git remembers who made it and when.

New to Vulnlog? Start with What is Vulnlog?, then install the CLI.

Find your path

Your scanner flagged a finding: Record the decision and unblock the build: Quickstart: triage your first finding.
You prepare the next release: See which vulnerabilities affect a shipped release and which updates the next release must carry: Quickstart: find what affects your release.
You need the impact picture: Read the report and state how the project is affected, without touching YAML or a build: Quickstart: read the impact report.
Someone asks about a vulnerability: Answer a customer or user from the recorded decision instead of re-analysing: Quickstart: answer a vulnerability inquiry.

Returning readers

Reference: The Vulnlog file format, the CLI, and the Gradle plugin.
Concepts: why decisions live in git, the data model, and vulnerability states.
Stuck? Ask in the GitHub discussions.