vulkro why-not
Explain why the scanner did not report a finding at a file and line.
Command reference
Generated from vulkro why-not --help (vulkro 0.36.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.
Explain why the scanner did not report a finding at a file and line.
vulkro why-not [OPTIONS] <PATH[:LINE]>
Arguments
| Argument | Description |
|---|---|
<PATH[:LINE]> | Target as <path[:line]>, e.g. src/routes/users.js:42 |
Options
| Flag | Description |
|---|---|
--offline | Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set. |
--rule <RULE_ID> | Ask about one rule id (e.g. py-taint-sql-001); its family also narrows the absence reasons. |
--family <FAMILY> | Ask about one vulnerability family (e.g. sqli, cmdi, path-traversal, idor, missing-auth) |
-q, --quiet | Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged. |
--no-color | Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb. |
--path <DIR> | Project root to scan (default: the nearest ancestor of the target holding .git or a manifest) |
-f, --format <FORMAT> | Output format: table (default) or json (vulkro-why-not/1) Default: table. |
-h, --help | Print help (see a summary with '-h') |
Full vulkro why-not --help
Explain why the scanner did not report a finding at a file and line.
Explain why `vulkro scan` did NOT report something at a location: `vulkro why-not <path[:line]>`. The deterministic scan runs once as the oracle. If a finding WAS reported there it is printed (the honest answer is "it did"); if one exists but the default view hides it (below the confidence floor, in an unreachable file, suppressed by `.vulkro/triage.toml`, `.vulkro/allowlist` or a `vulkro:disable` directive, folded into another issue) the hidden finding and the switch that shows it are printed. Otherwise the reasons the scanner stayed silent: not-ingested (coverage), sink-not-modelled, no-entry-point, guard (the guard oracle's verdict), neutraliser, source-not-recognised, no-flow.
This is a BEST-EFFORT explainer: the lexical neutraliser, sink and source checks are labelled as such, and no engine is re-run in a candidate mode.
Exit codes: 0 = nothing exists at the location (the reasons explain the silence); 1 = a finding exists there (reported, hidden or suppressed); 2 = error (bad target, unknown family, unscannable path).
Usage: vulkro why-not [OPTIONS] <PATH[:LINE]>
Arguments:
<PATH[:LINE]>
Target as `<path[:line]>`, e.g. `src/routes/users.js:42`
Options:
--offline
Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
--rule <RULE_ID>
Ask about one rule id (e.g. `py-taint-sql-001`); its family also narrows the absence reasons
--family <FAMILY>
Ask about one vulnerability family (e.g. `sqli`, `cmdi`, `path-traversal`, `idor`, `missing-auth`)
-q, --quiet
Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged
--no-color
Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb
--path <DIR>
Project root to scan (default: the nearest ancestor of the target holding `.git` or a manifest)
-f, --format <FORMAT>
Output format: table (default) or json (`vulkro-why-not/1`)
Possible values:
- table: Human-readable answer (default)
- json: The `vulkro-why-not/1` JSON answer
[default: table]
-h, --help
Print help (see a summary with '-h')