VerdictGit stores every triage decision as a human-readable YAML file in your own git repo — then auto-applies those decisions to every future scan, from any scanner, forever. Dismiss a false positive once; it stays dismissed through every migration, renewal and re-scan.
Works with the scanners you already run
Native report formats for Trivy, Grype and OSV-Scanner; SARIF 2.1.0 for everything else. If a scanner can export it, VerdictGit can remember your verdicts on it.
Your team has already decided most of these findings. The decisions just live in the wrong place — inside a tool you won't keep.
Switch scanners — or let one change its pricing, terms or roadmap — and every false positive, every accepted risk, every "we already looked at this" evaporates. Your team re-triages thousands of findings from a blank page, for weeks.
In every incumbent platform, your triage history is a feature of their database. An export button is not a memory: it gives you a spreadsheet, not decisions that keep applying themselves to tomorrow's scans.
Ask why a finding is still open and the honest answer is often a person — the engineer who investigated it in March, who left in June. When verdicts live in tickets and heads, audits take days. When they live in git, they take seconds.
Point VerdictGit at a Trivy, Grype or OSV-Scanner report — or any SARIF 2.1.0 export. Findings are canonicalised against a local OSV alias snapshot, so the same vulnerability is recognised no matter which scanner, or which ID scheme, reported it.
Mark a finding false positive, confirmed, or accepted-risk with an expiry. The verdict is written as a readable YAML file and committed to your repository, under your name, with your reasoning. Click any applied verdict and VerdictGit shows its evidence: the match basis, the version check, the history, the commits.
Every new scan is reconciled against your verdict store before a human sees it. Matches are tiered: only EXACT matches auto-apply. Anything less certain arrives as a suggestion for one-click confirmation, expired accepted-risks resurface on schedule, and a verdict can never silently land on the wrong finding.
Run both scanners in parallel and VerdictGit reports exactly how much of your triage history carries over — before you sign, renew or cancel anything.
On the full benchmark corpus, cross-scanner matching recall measured 97.8–100% depending on direction — with zero verdicts ever applied to the wrong finding.
$ verdictgit migrate-report --from trivy --to grype
COVERAGE: 80.0% of verdicts earned on trivy carry over to grype (4 of 5)
from run: 0fab7c6354e971bfe6473ef8 (trivy, 180 findings)
to run: c5b4b2f4900ace8e140d335f (grype, 180 findings)
verdicts considered: 5
carried (EXACT auto-apply): 3
carried with confirmation (PROBABLE): 1
lost (no counterpart): 1
carried_with_confirmation 7cfc6738ce3c CVE-2023-4863 in pkg:pypi/pillow@8.2.0 — alias group contains multiple CVEs — confirm the verdict covers this advisory
carried 8f3d0b37ddb7 CVE-2020-28500 in pkg:npm/lodash@4.17.20
carried 969fbc7a6530 CVE-2021-23437 in pkg:pypi/pillow@8.2.0
carried bd199246c4b1 CVE-2021-23337 in pkg:npm/lodash@4.17.20
lost cc67cf367f05 CVE-2021-31542 in pkg:pypi/django@3.2.0 — accepted_risk expired before the target run — resurfaces for re-triage instead of carryingUnedited output from a real run on the benchmark corpus that ships in the product's test fixtures — the same Trivy and Grype reports, five verdicts written against Trivy. No staging, no mock data: reproduce it yourself.
VerdictGit is bought by security teams, so it is engineered to survive their review — starting with the fact that there is no VerdictGit cloud.
One 19.6 MB binary for Linux, macOS or Windows — console included, no runtime dependencies, no agents phoning home. Run it on a small VM inside your network, or fully air-gapped with a local OSV snapshot.
Verdicts are YAML files in a repository you own, in an open, documented format. If VerdictGit disappeared tomorrow, you keep every decision, every reason, every author — readable by humans and by any tool that reads YAML.
The product can print its complete network inventory: verdictgit egress-report. On a default install it lists zero destinations. Your findings data has nowhere to go, because there is no vendor server for it to go to.
Licences are signed Ed25519 keys, verified locally — no activation servers, no telemetry. And enforcement is never hostage-taking: reads, history and exports always work; only new verdict writes pause, after expiry plus a 30-day grace period.
The features enterprise platforms charge extra for — SSO, audit, access control — are simply in the product, at every price.
CVE, GHSA, PYSEC, vendor IDs — canonicalised through a local OSV snapshot so a verdict follows the vulnerability, not one scanner's naming.
EXACT auto-applies. PROBABLE becomes a suggestion with its evidence attached. CONFLICT goes to a human. A wrong silent apply is treated as the worst failure this product can have.
Accepted risks must carry an expiry date. When it passes, the finding resurfaces in the queue automatically — via the built-in scheduler or a one-shot cron run.
Confirmed verdicts become Jira issues; when an issue closes as Done, VerdictGit proposes the verdict — a human approves before anything is written. Sync never silently authors a decision.
Select fifty findings, give one reason, land one auditable commit. The five-second path from "we know this one" to "it never bothers us again".
Every verdict is a commit: author, timestamp, reason, evidence. Answer "why is this still open?" with a link, not a week of archaeology — and export the whole history for auditors as a self-contained bundle.
Sign in through your identity provider with just-in-time provisioning; admin, triager and viewer roles; local admin retained as break-glass. Included, not an enterprise add-on.
The verdict format is an open specification with a published JSON Schema — your exit is guaranteed by design. The matching engine is the product you pay for.
No per-seat, per-scan or per-finding arithmetic — the pricing-model unpredictability that drives teams off other platforms is the thing we refuse to ship.
$999one-time
Pay once. Run VerdictGit for the life of your company — every update included, nothing to renew, ever.
50 founding licences, issued as signed offline keys. When they're gone, they're gone — after that, Standard is the only way in.
30-day money-back guarantee — full terms
$349/ month
The complete product for one company — every feature, every scanner, governance included.
Prefer annual? Standard is also available as a yearly licence key — same flat logic, issued the same offline way.
No. VerdictGit is a self-hosted binary that runs inside your network. There is no VerdictGit cloud and no telemetry. Run verdictgit egress-report on your install and it prints every network destination the product can talk to — on a default install, that list is empty.
Your team's triage decision on a finding: false_positive, confirmed, accepted_risk (always with an expiry date), fixed, duplicate_of or needs_review — stored with a mandatory reason, the author's identity and the date, as a human-readable YAML file committed to your git repository.
Trivy, Grype and OSV-Scanner through their native report formats, plus anything that exports SARIF 2.1.0 — including Semgrep and Snyk exports. Jira is supported as a two-way sync: verdicts out, human-approved proposals back in.
Nothing. The verdict files live in your repository, in an open format with a published schema. Reads, history and auditor exports always work — even with an expired licence, only new verdict writes pause, and only after a 30-day grace period. Founding licences are one-time, so there is nothing to lapse in the first place.
Because git is the audit system your engineers already trust: immutable history, named authors, review by pull request, and backups you already have. The verdict format is deliberately open — the format is the guarantee, the matching engine is the product.
Those are scanners and platforms: they find vulnerabilities, and your triage history lives inside their cloud, on their terms. VerdictGit is not a scanner at all — it is the memory layer above whichever scanners you run, keeping the history in your repo so the scanner underneath becomes replaceable. Keep your scanner. Lose the lock-in.
A one-time payment of $999 for a lifetime licence for your company: the complete product, all future updates included, delivered as a signed offline licence key. It is limited to the first 50 companies — when the cohort fills, Standard ($349/mo) is the only way in.
Download one binary (Linux, macOS, Windows) or run the container image, point it at a git repository and a data directory, and ingest your first report — about ten minutes, end to end. It runs happily on a small VM and works air-gapped with a local vulnerability snapshot.
Founding licences are issued personally, not through a web store. Here is exactly how it works — three steps, no sales call.
Tell us your company name and which scanner you run today. That is all we need to start.
We run VerdictGit's migration report on two of your own scanner reports, with you, and show you exactly how many of your past verdicts would carry over. Your reports never leave your network — the check runs on your machine, in your environment.
If the numbers convince you, our payment provider invoices you, and your signed lifetime licence key is delivered. Install takes about ten minutes — and the 30-day money-back guarantee starts the day your key arrives.
Founding cohort opens with the first announcement — the enquiry address will be published here.
Join the founding cohort: $999 once, a lifetime licence, every update included — for the first 50 companies only. Founding licences are issued personally, as signed offline keys — no store, no account, no sales call.