Documentation

As seen in: Help Net Security · Development Curated · Press coverage →

CVE Lite CLI is designed around short local feedback loops: scan a lockfile, understand whether findings are direct or transitive, apply the safest supported fix command, and rescan before code reaches CI.

Start here

• Getting Started explains how to get started
• Workflow Integration explains how to integrate with CI, GitHub Actions, GitHub Code Scanning (SARIF upload), git hooks, and offline mode.
• Remediation Strategy explains how the CLI chooses direct upgrades, parent updates, and parent upgrades.
• Fix Mode Guide explains the conservative --fix workflow.
• Override Hygiene Auditing audits overrides and resolutions for stale, broken, and ineffective pins across npm, pnpm, Yarn, and Bun (rules OA001-OA011 and PD001-PD002).
• HTML Vulnerability Report explains the local dashboard generated by --report.
• How CVE Lite CLI Works covers the scanner model and lockfile-first behavior.

Compare and validate

• Comparison with Other Tools compares CVE Lite CLI with Dependabot, npm audit, OSV-Scanner, Snyk, and Socket.
• Parser Coverage documents package-manager support and fallback behavior.
• Case Studies show real project scans and remediation journeys — including verified lockfile snapshots for Astro (pnpm, 2,228 packages), Turborepo (pnpm, 1,776 packages), Visual Studio Code (npm root lockfile, 1,374 packages), and Storybook (Yarn Berry, 3,008 packages).

Teaching and learning

Teach dependency security with CVE Lite Classroom: free, open-source, hands-on exercises covering vulnerability remediation, critical review of AI-assisted fixes, and CI security gates. Includes runnable applications, instructor guides, worked solutions, and grading rubrics, with tracks for npm, pnpm, Yarn, and Bun.

Explore the classroom exercises →

CVE Lite Classroom is a companion project maintained by the author of CVE Lite CLI, separate from the OWASP project.