Segrep

segrep-vuln scanner

Opt-in local vulnerability scanner with optional Trivy parity shadow

Opt-in dependency vulnerability scanner for Segrep that prioritizes local lockfile analysis and can optionally run a parity shadow comparison against external Trivy.

segrep-vuln is designed for controlled rollout of local vulnerability detection without changing default Trivy behavior.

Why use segrep-vuln

  • Keeps the trivy scanner unchanged for teams that need current Trivy behavior by default.
  • Enables local lockfile vulnerability scanning for faster dependency-focused scans.
  • Supports shadow parity against external Trivy so drift can be measured in CI.

Scanner behavior

segrep-vuln runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-vuln --format json

When parity shadow is enabled, it writes:

  • .segrep/segrep-vuln-parity.json

Modes

Configure execution mode with SEGREP_VULN_MODE:

  • auto (default): local lockfile vulnerability scan first, external Trivy fallback
  • local: require local lockfile path; fail if unsupported lockfiles are absent
  • external: force external Trivy path only

Supported local lockfiles:

  • package-lock.json
  • pnpm-lock.yaml
  • yarn.lock
  • requirements.txt
  • poetry.lock
SEGREP_VULN_MODE=auto pnpm segrep scan . --scanners segrep-vuln

Parity shadow mode

Enable parity shadow to compare local and external vulnerability sets:

SEGREP_VULN_PARITY_SHADOW=true pnpm segrep scan . --scanners segrep-vuln --format json

Parity report fields include:

  • status (compared or skipped)
  • summary.localCount
  • summary.externalCount
  • summary.localOnlyCount
  • summary.externalOnlyCount
  • sample vulnerability keys from both delta sets

If external Trivy is unavailable, parity status is skipped and the scan still succeeds in best-effort mode.

CI parity gate

Use the parity verifier script to enforce drift thresholds:

node scripts/ci-verify-vuln-parity.js \
  apps/cli/fixtures/vulnerable-repo/.segrep/segrep-vuln-parity.json \
  --max-local-only 0 \
  --max-external-only 0

Optional flag:

  • --allow-skipped for environments where external Trivy parity is not always available

Promotion-readiness signal (non-blocking):

node scripts/ci-verify-vuln-parity.js \
  apps/cli/fixtures/vulnerable-repo/.segrep/segrep-vuln-parity.json \
  --max-local-only 0 \
  --max-external-only 0 \
  --report-only \
  --label promotion-readiness

Recommended threshold tightening rollout:

  • Start with --max-local-only 1 --max-external-only 3
  • Tighten toward 0/0 once parity drift stabilizes

Docker usage

docker run --rm -v "$(pwd):/repo" \
  -e SEGREP_VULN_PARITY_SHADOW=true \
  security-scanner:local \
  scan /repo --scanners segrep-vuln --format json

Relationship to trivy scanner

  • trivy scanner: external Trivy wrapper (local binary or Docker image)
  • segrep-vuln scanner: local vulnerability implementation with optional parity shadow

Use both when validating migration:

pnpm segrep scan . --scanners trivy,segrep-vuln --format json

Related docs