<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Dependency Vulnerability Scanning — API Reference

## Trivy CLI

```bash
# Filesystem scan
trivy fs . --format json --severity CRITICAL,HIGH

# Scan specific lockfile
trivy fs --scanners vuln package-lock.json

# License scan
trivy fs --scanners license --severity HIGH,CRITICAL .

# SBOM scan
trivy sbom sbom.spdx.json --format json

# Image dependencies
trivy image --scanners vuln myapp:latest
```

## Grype CLI

```bash
# Scan directory
grype dir:. --output json

# Scan SBOM
grype sbom:sbom.spdx.json --output json

# Fail on severity
grype dir:. --fail-on high

# Only fixed vulnerabilities
grype dir:. --only-fixed
```

## OSV-Scanner CLI

```bash
# Recursive scan
osv-scanner --recursive .

# Scan lockfile
osv-scanner --lockfile requirements.txt

# JSON output
osv-scanner --recursive --format json .

# Scan SBOM
osv-scanner --sbom sbom.spdx.json
```

## Syft (SBOM Generation)

```bash
# SPDX JSON
syft . --output spdx-json=sbom.spdx.json

# CycloneDX
syft . --output cyclonedx-json=sbom.cdx.json

# Table format
syft . --output table
```

## Key Vulnerability Databases

| Database | URL | Coverage |
|----------|-----|----------|
| NVD | nvd.nist.gov | All ecosystems |
| GitHub Advisory | github.com/advisories | npm, pip, gem, go, cargo |
| OSV | osv.dev | Multi-ecosystem |
| Snyk Vuln DB | snyk.io/vuln | npm, pip, maven, go |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No vulnerabilities found |
| 1 | Vulnerabilities detected |
| 2 | Scan error |
