---
title: "Say which known holes do not affect you · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/supply-chain/vex
id: APS-106
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 962
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Say which known holes do not affect you with VEX

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-106
- Level: Recommended
- Chapter: [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)
- Rule: A scanner may report a vulnerable package that cannot be exploited in your product. Record a VEX statement for it, with the status not affected and a justification. Suppress findings only through these statements.
- Check: CI runs the scanner with the VEX file. It fails on any finding not covered by a statement, and on any statement with the status not affected but no justification. The scanner's own ignore list is empty.
- How: VEX stands for Vulnerability Exploitability eXchange. A statement names the product, the vulnerability and one status, such as not affected, affected, fixed or under investigation. A not affected status needs a reason, such as the vulnerable code is not present or never runs. Write statements in a standard format, such as OpenVEX, CycloneDX or CSAF. Give your scanner the VEX file, so the next run stays quiet for those findings and still fails on new ones. Publish the statements with the [bill of materials](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) for software that customers run, so they skip the same triage. Fix deadlines for the rest are in [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://example.com/vex/2026-10-27",
  "author": "Example Shop security team",
  "timestamp": "2026-10-27T09:00:00Z",
  "statements": [{
    "vulnerability": { "name": "CVE-2026-12345" },
    "products": [{ "@id": "pkg:oci/shop@sha256:4f1c..." }],
    "status": "not_affected",
    "justification": "vulnerable_code_not_in_execute_path"
  }]
}
```

### Shell example

```sh
trivy image --vex vex.json --exit-code 1 registry.example.com/shop:2026.10.27
```

## Sources

- [CISA Minimum Requirements for Vulnerability Exploitability eXchange](https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex)
- [OASIS CSAF Version 2.0](https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html)

## Related rules

- APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security
- APS-81 [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/supply-chain/vex">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Verify signatures and provenance before you install or deploy](https://agentwranglers.se/playbook/application-security/supply-chain/verify-provenance.md)
- [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)