Getting started
Install
Verifi is a single self-contained binary with no runtime dependencies.
curl -fsSL https://raw.githubusercontent.com/verifisecurity/verifi/main/install.sh | sh
Or download a build from Releases.
Download the advisory database
Verifi matches your dependencies against the OSV advisory database. Download it
once; it is stored in ~/.verifi/osv and shared by every project on the machine.
verifi update
Scan a project
Point status at a project with a lockfile:
verifi status path/to/project
You get, for each vulnerable package, whether your code imports it, the version
to upgrade to, what that clears, and the limits of what has been checked. Nothing
is written to your project; status is read-only.
What next
- Understand the output: reading status.
- Understand the confidence rung on each fix: confidence.
- Turn a finding into a change: fixing vulnerabilities.