DevGuard Crowdsourced VEX API
Most VEX decisions are not unique. If a vulnerability in a widely used library is unreachable in your configuration, it is probably unreachable for everyone else using it the same way. Crowdsourced vexing surfaces the assessments other DevGuard users have already made so you do not have to repeat the analysis.
This API returns those recommendations for an asset — either across all of its vulnerabilities in one call, or for a single dependency vulnerability when you are triaging one finding.
Recommendations are advisory. They tell you how others assessed the same vulnerability in the same component; they do not change your own state. Applying one is a separate, deliberate step through the VEX Rules API, and the judgement of whether a recommendation fits your context remains yours.
Related Documentation
- VEX Rules API — recording the decision you settle on
- VEX Rules — how rules are written and applied
- What is VEX — the concept behind these recommendations
- Prove Not Affected — justifying a not-affected decision
- Reduce False Positives — where this fits in triage
- Use the DevGuard API — authentication and conventions
- DevGuard API Reference