Who is using CVE Lite CLI? Share your use case #481
Replies: 6 comments 8 replies
-
|
I'm using it for LehrGrapht. It runs exclusively in the CI pipeline with each run to check early if there is something wrong. For the normal pipelines that builds/deploys I'm using with |
Beta Was this translation helpful? Give feedback.
-
|
CVE Lite is the third ScanSource in HexOps (https://github.com/Hexaxia-Labs/hexops) (our open source dev ops dashboard) alongside Grype and pnpm-audit. It runs on every project audit in local dev and CI across about 30 active projects, mostly pnpm with some npm. Two concrete wins for us:
The remediation-first design and the parent-graph walking compose well with how we already think about dependency hygiene. Rooting for Lab status. It's earned. Full writeup: https://labs.hexaxia.tech/blog/hexops-cve-lite-integration/ |
Beta Was this translation helpful? Give feedback.
-
|
We are currently using CVE Lite CLI to monitor security across several of our projects, handling both npm and Yarn lockfiles. Right now, it fits perfectly into our local dev workflow, and we are evaluating integrating it as a pre-commit hook in the near future. The biggest value for us is the ability to catch security issues as early as possible in the development cycle, and this tool is ideal for providing that fast, local feedback loop. Great work on the project, happy to support the path to OWASP Lab status! |
Beta Was this translation helpful? Give feedback.
-
Using CVE Lite CLI on a production TypeScript projectSharing how I've been using Context: I run servarat.net and maintain a React + Vite + TypeScript frontend (shadcn/ui, React Router, the usual transitive sprawl). I wanted a fast pre-push vulnerability check that lives in my terminal, not at the end of a CI pipeline. How I run it: straight from the project root, no install —
First run pulls the package, after that rescans are near-instant. Nothing leaves the machine. What stood out vs
Real result: I didn't just scan — I applied the full remediation plan on the same project afterward (patched postcss/react-router/brace-expansion, did the Vite 6 + Vitest 4 majors deliberately with build/test smoke checks). The fix plan held up; the rescan came back clean apart from a residual advisory the tool itself had already flagged on the upgrade target, which I appreciated the honesty on. I wrote the whole process up in detail here, including the Nice work on this — it fits the gap where I actually make decisions (the terminal, before the commit) instead of nagging from a dashboard I've learned to ignore. |
Beta Was this translation helpful? Give feedback.
-
|
Where: We use CVE Lite CLI in (github.com/latchgate-ai/latchgate) CI pipeline - hard gate on every PR and merge to main. Package manager: npm (TypeScript SDK). We pin the action by commit hash and run it with What it solves: LatchGate is an execution security kernel for AI agents. The project ships Rust crates, a Python SDK, and a TypeScript SDK, so we need vulnerability coverage across all three ecosystems. CVE Lite CLI covers the npm side, it sits alongside cargo audit + cargo deny for Rust and pip-audit for Python, plus a 7-day dependency freshness check that rejects anything published too recently (supply-chain hygiene). For a project whose entire point is enforcing security boundaries around untrusted code, shipping a dependency with a known high-severity CVE is unacceptable. CVE Lite CLI makes that a build failure instead of the exposure. Good tool, glad it exists. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for this tool and the goal of the project. I have been developing a Universal shell called akaSHa "Akasha" for DevOps / Production support teams. At this time I am integrating this tool into my shell. Universal AI Core Terminal: Driven by the next-generation google-genai automation engine for contextual code translation, intelligence parsing, and direct environment feedback loops. https://github.com/WSWATERMAN/Omni-Ever-Expanding-Nebula-Noodle |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
If you are using CVE Lite CLI in your projects or at your company, we would love to hear about it.
Drop a comment below with:
No need for a long writeup — even a sentence or two helps.
This thread helps the community discover real-world adoption patterns and helps us understand where CVE Lite CLI is most useful. It also supports our goal of growing toward OWASP Lab Project status.
If you are using CVE Lite CLI in a public repo, please consider adding the CVE Lite CLI badge to your repo. It helps other projects discover the tool and shows the community who's using it: https://github.com/OWASP/cve-lite-cli#add-a-badge-to-your-project
Thanks for being part of the project.
Beta Was this translation helpful? Give feedback.
All reactions