Skip to main content

Frequently asked questions (FAQ)

We have gathered the questions you commonly run into while using Vulinder. Each answer includes a link to a document with more detail, so follow whatever item you need.

What targets can I analyze?​

You can analyze source code, container images, running web services, servers (hosts), uploaded SBOMs, and built binary files. Each type has different requirements and different analyses you can enable. For registration methods by type, see the following documents.

If you are new, we recommend starting with the Usage guide.

How long does a scan take?​

It depends on the size of the target. Scans run asynchronously, so you do not need to keep the screen open, and progress is shown in real time. When a scan finishes, a result summary and deep link are delivered to the channels set in Notification settings.

There are too many false positives.​

Handle each item in one of the following ways. (Vulnerability management)

  • False positive : An item that is not a real risk. It stays a false positive and does not return to open even if a later rescan detects it again.
  • Accepted risk : Track items you have decided not to fix now separately.

Can I scan any website with DAST?​

No. To prevent abuse and SSRF, you can only scan domains whose ownership has been verified. After registering the service, you verify domain ownership in the service settings using one of the following. (Web service (DAST))

  • File upload
  • DNS TXT record
  • Meta tag

I received a new vulnerability alert even though I did not run a scan.​

That is normal behavior. Because SBOM inventory and dependency (SCA) information are monitored continuously, when a new CVE is published for a component you have already registered, it is detected and reported without a rescan. You can see whether you are affected and which assets are involved.

For details, see Notifications and Security news: continuous monitoring and alerts.

How do I share results externally?​

You can export results in the following two formats.

  • PDF report : A summary
  • VEX document : The response status of vulnerabilities

You can use these directly for audits and customer responses. (Reports · VEX)

I cannot see a certain feature.​

Menus appear differently depending on the service type and your role.

  • Service type : DAST appears only for the web service type, and runtime monitoring only for the server / host type.
  • Role : The organization management, vulnerability management, notification settings, and SLA settings menus are visible only to admins and managers.
  • Plan : The analysis features themselves are all available regardless of plan.

I have another question.​

If you did not find your answer here, reach out via Contact. If the terminology is unfamiliar, the Glossary helps, and if you have questions about status labels, the Status dictionary helps too.