aertunmanual

Vulnerability management

Decide vulnerabilities, publish what you decided, and fix the ones that matter.

In the consoleVulnerabilities

  1. Import what is known

    aertun vuln import --bom sbom.json --where api --osv osv.json --kev kev.json --epss epss.csv
aertun vuln reach --source ./src --where api

    reach reads the asset's source for the symbols each open advisory names, and records what it found against that advisory.

  2. Say what each asset is

    aertun vuln asset ISSUER:VALUE --exposure open --impact high --because "public API"

    Exposure is small, controlled or open; impact is low, medium, high or very high.

  3. Read the queue and the plan

    aertun vuln queue
aertun vuln plan
aertun vuln why CVE-2026-0001

    The plan is the smallest set of upgrades that clears the most risk.

  4. Decide, and publish

    aertun vuln assess CVE-2026-0001 PKG not_affected
aertun vuln accept CVE-2026-0002 PKG --owner dana --until 2027-01-31 --because "..."
aertun vuln vex --author "Example Ltd" --id https://example.com/vex/1

    The statuses are affected, fixed, not_affected and under_investigation. A risk acceptance names its owner, its end date and its reason.

Code and dependencies

aertun sca scan --bom sbom.json --osv db.json
aertun sarif read results.sarif
aertun appsec triage