Concepts

The few ideas you need to read VulnGraph's answers. Short definitions are in the Glossary.

Fleet, profile and run

A profile names a fleet: a set of repositories and the branches to scan. A run scans one profile and produces a report (the source of truth), a brief, a plan and PR sketches. Answers always come from a finished run and say when its data was produced (data_as_of).

Findings, exposures and evidence

An advisory is a published vulnerability (CVE or GHSA). An exposure is one advisory reaching one service. VulnGraph ties findings to what actually shipped and traces each one to the deepest place it enters the fleet: a shared base image, an owned library, an application lockfile or a copied binary. When evidence is missing, the edit site is left blank instead of guessed.

Start here

Start here is the ranked list of edits that remove the most risk first: the package, the file to change and how many services it helps. One shared upgrade often clears many services.

Plan and steps

The plan turns start here into ordered work. Each step is usually one pull request or image rebuild and has:

• a rank (#1 first; ranks are stable for a run, so "step #12" means the same step everywhere);
• an edit site (repository, file and line) and what it clears;
• Waits on: the steps that must be merged first (a step can wait on several).

Steps are grouped by kind (shared bases, then application dependencies, then consumers that rebuild), and laid out by dependency depth.

Waves

The plan graph is drawn in columns called waves. Start now holds steps that wait on nothing. Wave 2 can start once the steps it waits on are merged, and so on. Several steps can start in parallel.

Decide

A step is marked Decide when the package is vulnerable and no fixed version has been published. A person must choose a path: replace the dependency, patch it, mitigate, or accept the risk. The step still points at the real edit site, and its options are numbered so the choice can be recorded.

MStF (Minimal Severity to Fix)

MStF is the lowest severity you have decided must be fixed. In the app it is the Fix from control. It decides which Decide steps are blockers:

Fix from	Decide steps that block
CRITICAL	critical only
HIGH	high and critical
MEDIUM	medium and above
LOW	low and above
UNKNOWN	all severities
Decide only	every Decide step

Lowering the floor adds blockers; it never removes higher ones. MStF does not hide ordinary upgrade steps.

Blockers and blocked steps. Blockers are shown in red and go first in the work order. A step that waits on a blocker counts as blocked until someone decides, but it is not painted red. The work order prefers the blockers that unblock the most other steps, then the remaining steps by rank, and always respects Waits on.

MStF versus the severity filter. The severity checkboxes only hide or show rows on screen. They do not change blockers or the work order.

Sketch

A PR sketch is the proposed change for a step: title, description and file edits. For each MStF there is one sketch in work order, so a person or an agent can apply the steps top to bottom without inventing a different order.

Progress on steps

People and agents record progress on steps: a decision on a Decide step, and a status (in_progress, pr_opened, pr_merged, pr_closed, skipped) with the PR link. The plan itself is never rewritten; progress is shown next to it.