vulkro baseline

Run a scan and write a baseline JSON file (default .vulkro-baseline.json) that scan --baseline and scan --ratchet can compare against. The baseline is an array of finding records; it captures the current state so future scans can gate on new findings only.

Usage

vulkro baseline [PATH] -o .vulkro-baseline.json

Argument	Description	Default
PATH	Path to the project root.	.

Flags

Flag	Description
--out, -o <PATH>	Output file. Defaults to .vulkro-baseline.json in the repo root.
--no-cache	Bypass the per-file extraction cache (same as scan --no-cache).

Examples

# Write the baseline once, then commit it.
vulkro baseline . -o .vulkro-baseline.json
git add .vulkro-baseline.json

# Later scans exit 1 only on findings new vs the baseline.
vulkro scan . --ratchet

Related

• vulkro scan --ratchet - gate on new findings vs the baseline.
• vulkro gate - two-tree gate against a git ref (no baseline file).
• Baselines explained - when to use each.

Command reference

Generated from vulkro help baseline on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Save the current findings as a baseline so later scans only report what is new.

Run a scan and write a baseline JSON file (default `.vulkro-baseline.json`) that `scan --baseline` / `scan --ratchet` can compare against. The baseline is the same shape `--baseline` already reads: an array of `SecurityFinding` records.

Exit code: 0 baseline written, 2 scan / IO error. It snapshots findings rather than failing on them, so it never returns 1.

Usage: vulkro baseline [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
  -o, --out <PATH>
          Output file. Defaults to `.vulkro-baseline.json` in the repo root

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --no-cache
          Bypass the per-file extraction cache (same as `scan --no-cache`)

  -h, --help
          Print help (see a summary with '-h')