Automation, baselines, and reports

Create stable gates, compare reports, and keep existing findings visible.

Run non-interactively

Use --ci in scripts and build systems. VICE exits successfully when the score meets the threshold and fails when it does not. Set the threshold explicitly so the policy is visible in the command.

Explicit policy

vice audit . --ci --min-score 80 --min-confidence high --severity-min HIGH

Baseline reviewed findings

A baseline snapshots the stable fingerprints of current findings. Future audits keep those findings in the result but exclude them from the new-finding gate.

Create and bypass a baseline

1vice baseline .
2vice audit . --ci
3vice audit . --ci --no-baseline

A baseline is not a fix

Commit the baseline only after review. Remove entries as issues are fixed and periodically run without it to see total exposure.

Compare two runs

Use fingerprints to separate added, unchanged, and resolved findings. Compare engine, ruleset, scoring, and coverage metadata before treating every delta as a code change.

Report diff

1vice diff scans/old.json scans/new.json
2vice diff scans/old.json scans/new.json --markdown

Store the right format

JSON preserves the complete machine-readable result for custom automation.
SARIF integrates source findings with compatible code-scanning tools.
Markdown from diff is useful for a review summary.
Badge JSON is a public status signal and should not contain sensitive evidence.

Protect CI artifacts

VICE masks sensitive values, but reports can still reveal private paths, hostnames, and security posture. Give report artifacts the same retention and access controls as other security output.

Continue with VICE

Review the open source engine, modules, and scope controls.

Explore the VICE engine