Skip to main content

vulkro review

Show the findings that sit on lines your git change touched, like a code review.

Command reference​

Generated from vulkro review --help (vulkro 0.36.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Show the findings that sit on lines your git change touched, like a code review.

vulkro review [OPTIONS] [PATH]

Arguments​

ArgumentDescription
[PATH]Path to the project root. Defaults to the current directory. Default: ..

Options​

FlagDescription
--offlineHard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set.
--stagedReview only staged changes (git diff --cached)
--last-commitReview the most recent commit (HEAD~1..HEAD)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--commit <REV>Review a single commit's own diff (<rev>^..<rev>)
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
--range <SPEC>Review an arbitrary range: A..B, A...B (merge-base), or a bare <ref> (treated as <ref>..HEAD)
-f, --format <FORMAT>Output format: human (default) or json Default: human.
--context <N>Diff context lines to show around each change. Overrides VULKRO_REVIEW_CONTEXT; defaults to 3.
--baseline <REF>Precise NEW-vs-existing classification by scanning the given base ref in a temporary worktree and comparing finding fingerprints (slower, but catches a finding whose meaning changed without its line moving). Without this, a finding on an added line is NEW and one on an unchanged context line is existing.
--fail-on <FAIL_ON>Gate threshold: exit 1 when a NEW finding at or above this severity exists. One of critical, high, medium, low, or none. Default low (any real finding gates). none never gates. Default: low.
-h, --helpPrint help (see a summary with '-h')
Full vulkro review --help
Show the findings that sit on lines your git change touched, like a code review.

Review the security findings on your git changes: scan the tree, then show only the findings that land on the lines this change touched, rendered as an inline diff (the way a code-review tool shows issues on the lines you changed). Each finding is tagged NEW (introduced by this change) or existing (already there on an unchanged line).

Scope (pick at most one; default is the working tree): (default)       uncommitted changes: `git diff HEAD` + untracked files --staged        only staged changes: `git diff --cached` --last-commit   the most recent commit: HEAD~1..HEAD --commit <rev>  that commit's own diff: <rev>^..<rev> --range <spec>  A..B, A...B (merge-base), or a bare <ref> (since <ref>)

A NEW finding whose `disposition` is `not-examined` is shown in the review but never fails the run, at any severity. See `vulkro gate --help` for why, and for the VULKRO_GATE_SEVERITY_ONLY escape hatch.

Environment variables: VULKRO_REVIEW_CONTEXT       Default diff context lines (overridden by --context). Default 3. VULKRO_GATE_SEVERITY_ONLY   Set to 1 to restore the previous behaviour: severity alone decides and `not-examined` rows fail the run again. Off by default.

Exit codes: 0  no NEW gating findings at or above --fail-on. 1  one or more NEW gating findings at or above --fail-on (the review is the report). Use `--fail-on none` for a report that never gates. 2  error: not a git repo, bad ref, or scan failure.

Never 0 when no source file could be examined at all: the changed files would be listed as reviewed and clean when nothing opened them. That case is 2 when nothing at all was reported and 1 when the passes that need no extractor did report findings.

Usage: vulkro review [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root. Defaults to the current directory
          
          [default: .]

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --staged
          Review only staged changes (`git diff --cached`)

      --last-commit
          Review the most recent commit (HEAD~1..HEAD)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --commit <REV>
          Review a single commit's own diff (`<rev>^..<rev>`)

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

      --range <SPEC>
          Review an arbitrary range: `A..B`, `A...B` (merge-base), or a bare `<ref>` (treated as `<ref>..HEAD`)

  -f, --format <FORMAT>
          Output format: `human` (default) or `json`
          
          [default: human]

      --context <N>
          Diff context lines to show around each change. Overrides VULKRO_REVIEW_CONTEXT; defaults to 3

      --baseline <REF>
          Precise NEW-vs-existing classification by scanning the given base ref in a temporary worktree and comparing finding fingerprints (slower, but catches a finding whose meaning changed without its line moving). Without this, a finding on an added line is NEW and one on an unchanged context line is existing

      --fail-on <FAIL_ON>
          Gate threshold: exit 1 when a NEW finding at or above this severity exists. One of `critical`, `high`, `medium`, `low`, or `none`. Default `low` (any real finding gates). `none` never gates
          
          [default: low]

  -h, --help
          Print help (see a summary with '-h')
Last updated on