diff --git a/README.md b/README.md index d1a52f5..30e79ab 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@
- CVE Lite CLI + CVE Lite CLI

CVE Lite CLI

Fast, developer-friendly vulnerability scanning for JavaScript and TypeScript projects.

@@ -65,6 +65,9 @@ cve-lite /path/to/project --json # SARIF output cve-lite /path/to/project --sarif --output reports/scan.sarif + +# Use a custom advisory endpoint +cve-lite /path/to/project --osv-url https://security.company.internal/osv ``` ## What it looks like @@ -96,16 +99,16 @@ cve-lite . ```

- CVE Lite CLI default output screenshot + CVE Lite CLI default output screenshot

Verbose examples:

- CVE Lite CLI verbose output screenshot - CVE Lite CLI verbose output screenshot - CVE Lite CLI verbose output screenshot - CVE Lite CLI verbose output screenshot + CVE Lite CLI verbose output screenshot + CVE Lite CLI verbose output screenshot + CVE Lite CLI verbose output screenshot + CVE Lite CLI verbose output screenshot

## Why this tool exists @@ -136,6 +139,7 @@ The project emphasizes: - direct vs transitive visibility - top-priority fixes and a suggested remediation plan - JSON and SARIF output for automation +- configurable advisory endpoint support via `--osv-url` for internal proxies or mirrors - a small, reviewable runtime footprint That narrow scope is deliberate. CVE Lite CLI is not trying to be a full application security platform or a broad multi-surface scanner. It is trying to be a lightweight, understandable, developer-first tool for teams that want practical vulnerability scanning without extra cost or complexity. @@ -176,7 +180,7 @@ Support for stricter network-controlled environments is planned on the roadmap, CVE Lite CLI is designed as a **local-first, metadata-only** scanner. Unlike traditional SaaS security platforms that require code uploads or heavy agent installations, this tool operates directly within the developer's environment. It focuses on the "moment of release"—providing a high-speed, low-noise assessment of the dependency tree by analyzing resolved versions in project lockfiles.

- CVE Lite CLI Workflow + CVE Lite CLI Workflow

### Workflow Specifications