Skip to main content
Plans: Every plan. On Free, VEX documents stay readable and downloadable, but new ones are refused. Who: any member uploads, retires and reactivates VEX documents and uses their statements; owners and admins create the API tokens that pipelines use.
Your scanners and suppliers often already know whether a vulnerability affects a component: govulncheck sees that your code never calls the vulnerable function, Dependency-Track holds your team’s analysis, and a supplier publishes CSAF advisories. A VEX document carries those verdicts. Pharus binds each statement to the components of one product family, shows it on the matches it is about, and lets you use it as your own VEX status.

​
What Pharus applies and what stays evidence

A VEX status you set yourself always wins. Pharus never changes it because of a document.

​
Supported formats

XML and SPDX documents aren’t read. The limits are 4 MB as sent, 50 MB uncompressed and 50 000 statements per document. Vulnerabilities inside an SBOM count too. When an SBOM from Trivy or Grype carries a vulnerabilities section, Pharus keeps it as a VEX document attached to that SBOM, and the SBOM’s page says “VEX in this SBOM” with the counts.

​
How statements bind to your components

Pharus binds each statement to the family’s components by purl or CPE, by a CycloneDX BOM-link, or to the product as a whole. A statement that names nothing Pharus can bind is counted as such on the document’s page and changes nothing.
  • Product version. A document uploaded with a Product version holds for that version only. Without one, it holds for every version the family has.
  • Newest wins. The newest statement per component and product version counts.
  • Replacement. A later document from the same tool for the same version replaces the earlier one. govulncheck, Trivy, Grype, Dependency-Track and OSV-Scanner each count as one source; for other documents, the source is the document’s own id.

​
Upload a VEX document

1

Open the upload dialog

Go to SBOMs and select Upload VEX.
2

Choose the family and version

Pick the Product family. Enter the Product version the document is about, or leave it empty when it holds for every version.
3

Choose the file

Drop a .json file on VEX file, or select Choose file. Use the sample loads govulncheck-style statements for the sample SBOM.
4

Upload

Select Upload VEX. Pharus confirms with the number of statements and findings, matches the family again and opens the document’s page.
If you send a file Pharus already has for that family, it says “This VEX document was already uploaded” and stores nothing new.

​
Send VEX from CI

Pipelines send VEX documents to POST /api/v1/vex with the same API token as the family’s SBOMs. The VEX tab of Connect a pipeline on the SBOMs page has ready-made steps with your endpoint filled in:
  • govulncheck: govulncheck -format openvex sent to /api/v1/vex.
  • Trivy or Grype: a CycloneDX SBOM with the findings inside, sent to /api/v1/sboms as usual.
  • Dependency-Track: the project’s VDR, exported with ?variant=vdr&format=json and sent to /api/v1/vex. It carries your analysis with the justification and details.
Dependency-Track can also send each analysis decision as it is made. See Dependency-Track.

​
The VEX documents list

Each family card on the SBOMs page has a VEX documents section with up to 10 documents, active ones first: Retired documents are shown muted and marked “Retired”.

​
A VEX document’s page

Select a document to open it.
  • Details: Product family, Applies to, Format, Tool, Author, Document ID, Document version, Issued, SHA-256 and size, Source, Sent by and Received. A document that came inside an SBOM names it under Came in SBOM.
  • Contents: how many statements have a verdict, how many are scanner findings without one, how many name nothing Pharus can bind, and how many current matches carry them.
  • Statements: each Vulnerability, Component, Status and Why (the justification, then the impact or action statement), up to 200 rows.
Download original gives you the file exactly as Pharus received it, for example gateway-g3-4.2.openvex.json. Every member can download it, also while the workspace is read-only.

​
Use the statements as your VEX

To take over one statement, select Use on the match. See use a statement as your own. To take over every not-affected statement in a document at once:
1

Open the document

On SBOMs, select the document in the family’s VEX documents section.
2

Use the statements

Select Use n not-affected statements, read the confirmation and select Use statements.
Every match still under investigation that the document says isn’t affected becomes Not affected, with the document’s justification and impact statement, as your statement. Matches you set yourself are left as they are. Statements without a justification are left for you to set one by one. Each change is recorded in the audit trail and shows in your advisories.

​
Retire or reactivate a document

Select Retire on the document’s page, then Retire document. Its statements stop counting: the evidence leaves the matches, and a Fixed status Pharus set from it changes back. The document stays in the audit trail. Reactivate makes its statements count again. It is refused while a later document from the same source for the same version is active.

Vulnerabilities

Upload a VEX document

Dependency-Track

SBOMs