---

🚀 What is Vulfy?

Vulfy is a lightning-fast vulnerability scanner that checks your project dependencies for known security issues across 9 programming languages. Built with Rust for maximum performance, it integrates with the OSV.dev database to provide accurate, up-to-date vulnerability information.

✨ Key Features

• 🔥 Lightning Fast - Async Rust performance with concurrent scanning
• 🌍 Multi-Ecosystem Support - npm, Python, Rust, Java, Go, Ruby, C/C++, PHP, .NET
• 📊 Multiple Output Formats - Table, JSON, CSV, SARIF for different use cases
• 🎯 OSV.dev Integration - Real vulnerability data from Google's Open Source Vulnerabilities database
• ⚡ Zero Configuration - Works out of the box, configure only what you need
• 🔄 CI/CD Ready - Perfect exit codes and formats for automated pipelines
• 🤖 Automation & Monitoring - Continuous Git repository monitoring with smart notifications
• 📋 Advanced Policy Engine - Custom vulnerability filtering and security policies
• 🔔 Multi-Platform Notifications - Discord, Slack, and webhook integrations

---

📚 Documentation

📖 Complete Documentation - Comprehensive guides, tutorials, and API reference

Quick Navigation

• 🚀 5-Minute Quick Start - Get scanning immediately
• ⚙️ Installation Guide - All installation methods
• 📋 CLI Reference - Complete command documentation
• 🤖 Automation Setup - Continuous monitoring
• 🔧 Configuration Schema - Full configuration reference

---

📦 Installation

Option 1: Pre-built Binaries (Recommended)

# Linux/WSL
curl -LO https://github.com/mindPatch/vulfy/releases/latest/download/vulfy-linux-x86_64.tar.gz
tar -xzf vulfy-linux-x86_64.tar.gz
sudo mv vulfy /usr/local/bin/

# macOS (Intel)
curl -LO https://github.com/mindPatch/vulfy/releases/latest/download/vulfy-macos-x86_64.tar.gz
tar -xzf vulfy-macos-x86_64.tar.gz
sudo mv vulfy /usr/local/bin/

# macOS (Apple Silicon)
curl -LO https://github.com/mindPatch/vulfy/releases/latest/download/vulfy-macos-aarch64.tar.gz
tar -xzf vulfy-macos-aarch64.tar.gz
sudo mv vulfy /usr/local/bin/

Option 2: Using Cargo

cargo install vulfy

Option 3: From Source

git clone https://github.com/mindPatch/vulfy.git
cd vulfy
cargo build --release
sudo cp target/release/vulfy /usr/local/bin/

Verify Installation:

vulfy --version
# Should output: vulfy 0.1.0

---

🏃‍♂️ Quick Start

Basic Vulnerability Scan

# Scan current directory
vulfy scan packages

# Scan specific directory
vulfy scan packages --path /path/to/project

# Only show high-severity vulnerabilities
vulfy scan packages --high-only

Generate Reports

# JSON for automation/CI
vulfy scan packages --format json --output security-report.json

# CSV for spreadsheet analysis
vulfy scan packages --format csv --output vulnerabilities.csv

# SARIF for GitHub Security tab
vulfy scan packages --format sarif --output vulfy.sarif

CI/CD Integration

# Fail build if high-severity vulnerabilities found
vulfy scan packages --high-only --quiet || exit 1

# Scan specific ecosystems only
vulfy scan packages --ecosystems npm,pypi --no-dev-deps

---

🎯 Supported Ecosystems

Ecosystem	Package Files	Status
📦 npm	package-lock.json, yarn.lock, pnpm-lock.yaml, package.json	✅
🐍 Python	requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml	✅
🦀 Rust	Cargo.lock, Cargo.toml	✅
☕ Java	pom.xml, build.gradle, build.gradle.kts	✅
🐹 Go	go.mod, go.sum, go.work	✅
💎 Ruby	Gemfile.lock, Gemfile, *.gemspec	✅
⚙️ C/C++	vcpkg.json, CMakeLists.txt, conanfile.txt	🆕 NEW!
🐘 PHP	composer.json, composer.lock	🆕 NEW!
🔷 .NET	*.csproj, packages.config, *.nuspec	🆕 NEW!

---

📋 Example Output

Beautiful Table Format (Default)

🔍 Scanning for package files...
📦 Found 6 package files across 4 ecosystems

🛡️  VULNERABILITY REPORT
┌─────────────────────────────────────────┬──────────────┬──────────┬─────────────────┬──────┐
│ Title                                   │ CVE ID       │ Severity │ Package         │ Year │
├─────────────────────────────────────────┼──────────────┼──────────┼─────────────────┼──────┤
│ Remote Code Execution in lodash        │ CVE-2021-123 │ 🔥 High  │ [email protected]   │ 2021 │
│ Path Traversal in express              │ CVE-2022-456 │ 🟡 Medium│ [email protected]  │ 2022 │
│ SQL Injection in sequelize             │ CVE-2020-789 │ 🔥 High  │ [email protected] │ 2020 │
└─────────────────────────────────────────┴──────────────┴──────────┴─────────────────┴──────┘

📊 SCAN SUMMARY
• Total packages scanned: 42
• Vulnerable packages: 8
• Total vulnerabilities: 12
• 🔥 High severity: 4
• 🟡 Medium severity: 6
• 🟢 Low severity: 2

📖 See All Output Formats - JSON, CSV, SARIF examples

---

🤖 Automation & Monitoring

Vulfy includes a powerful automation system for continuous security monitoring of Git repositories.

Key Automation Features

• 📂 Multi-Repository Monitoring - Track multiple Git repos with branch-specific scanning
• ⏰ Flexible Scheduling - Hourly, daily, weekly, or custom cron expressions
• 🔔 Smart Notifications - Rich Discord/Slack alerts with severity-based filtering
• 📋 Advanced Policy Engine - Custom vulnerability filtering with keyword matching
• 🔐 Authentication Support - GitHub tokens, SSH keys, private repository access
• 🏗️ Ecosystem Filtering - Per-repository ecosystem targeting for focused scans

Quick Automation Setup

# Initialize automation with example configuration
vulfy automation init --with-examples

# Validate configuration
vulfy automation validate

# Run manual scan using automation config
vulfy automation run

# Start continuous monitoring
vulfy automation start --foreground

Example Configuration

# Monitor multiple repositories
[[repositories]]
name = "my-web-app"
url = "https://github.com/user/my-web-app.git"
branches = ["main", "develop"]
ecosystems = ["npm", "pypi"]

[repositories.credentials]
username = "git"
token = "your_github_token_here"

# Schedule daily scans at 2:00 AM UTC
[schedule]
frequency = "daily"
time = "02:00"
timezone = "UTC"

# Discord webhook notifications
[[notifications.webhooks]]
name = "Security Alerts"
url = "https://discord.com/api/webhooks/..."
webhook_type = "discord"
enabled = true