VEX statements

A scanner reports every vulnerable package version it can see. Sometimes the vulnerable code is not in the image at all, or nothing can reach it. A VEX statement records that, with the evidence: the file, the build flag or the call path that rules the finding out.

Each statement is checked before Trivy may honour it, so a VEX can never hide a finding without proof. Anything that is fixable gets fixed instead. Every document below is also served as raw OpenVEX JSON at its own @id.