woof audit

Purpose

Audits project lockfiles against the OSV threat intelligence feed.

Synopsiswoof audit [OPTIONS]

$ woof audit [OPTIONS]

Flag	Type	Description
--dev	boolean	Audit only development dependencies
--prod	boolean	Audit only production dependencies
--audit-level <AUDIT_LEVEL>	string	Filter vulnerabilities by severity level. Useful for setting minimum thresholds in automated checks.
-i, --interactive	boolean	Interactive mode for manual review and selection of advisories to fix
-h, --help	boolean	Print help (see a summary with '-h')

If the project lacks a lockfile (e.g., package-lock.json, Cargo.lock), the command will fail as it cannot resolve exact dependency tree versions.
In air-gapped CI/CD environments, the OSV database query will timeout unless a local threat intelligence cache is provided.

Passing both --dev and --prod simultaneously.
Expecting woof audit to scan source code for exposed keys (use woof scan for secrets; audit is strictly for supply chain vulnerabilities).

0Scan completed successfully with no vulnerabilities meeting the specified audit level.
1Vulnerabilities were detected that met or exceeded the threshold.
2Configuration error, missing lockfile, or network failure preventing the OSV query.

woof audit

$ woof audit[INFO] Extracted 412 dependencies.✓ Audit complete. Zero vulnerabilities detected.

Audits all dependencies in the local lockfile against the OSV database.

woof audit --prod --audit-level high

$ woof audit --prod --audit-level high[!] 1 High severity vulnerability found in production dependencies.

Filters the audit to only production dependencies and sets the failure threshold to high.

woof audit --interactive

$ woof audit --interactive? 2 vulnerabilities found. Select advisories to attempt auto-remediation:

Launches the interactive wizard allowing you to manually review and fix vulnerable dependencies.