▶ vg scan --vulns → why → bisect — find it, attribute it, prove the gap (docs)

[vibgrate-team]

▶ Run the interactive CLI simulator →
_{Real recorded runs. Detect a vuln, see who introduced it, prove the patch never landed. No signup.}

Look how clean this is

Find the advisory. Attribute it. Prove the fix is still out. Watch it run.

vg scan --vulns --offline --package-manifest package-versions.json

vg why lodash

vg bisect lodash 4.17.21

Same three steps — the Example use cases on vg scan --vulns, vg why, and vg bisect. The CLI home is vibgrate.com/cli.

Detect — offline, known-vulnerable lodash

Why — who introduced it

Bisect — the patched version never landed

Notice: --vulns is opt-in; why reads the prior vuln scan for attribution; bisect reports the version line was never crossed. Watch the player for advisory ids and versions — do not paste a CVE table here.

New here? Getting started with Vibgrate CLI. More: known vulnerabilities, vg why, vg bisect.

— Vibgrate maintainers