hexr audit

Usage

hexr audit [options]

Default Scan

$ hexr audit

╔═══════════════════════════════════════════════════╗
║              Hexr Security Audit                   ║
╚═══════════════════════════════════════════════════╝

[1/3] Dependency Vulnerabilities (pip-audit)
  ✓ Scanned 47 packages
  ⚠  2 vulnerabilities found:
     • requests 2.31.0 → CVE-2024-xxxxx (Medium) — fix: 2.32.0
     • cryptography 41.0.0 → CVE-2024-xxxxx (Low) — fix: 42.0.0

[2/3] SBOM Generation (CycloneDX)
  ✓ Generated CycloneDX SBOM
  ✓ 47 components cataloged

[3/3] Container Image Scan
  ✓ Base image: python:3.11-slim
  ✓ 0 critical, 0 high vulnerabilities
  
Summary: 2 medium/low issues. No critical risks.

Options

path

Export CycloneDX SBOM to a file.

hexr audit --export sbom.json

flag

Verify that deployed Kubernetes state matches generated manifests (drift detection).

$ hexr audit --verify

Drift Detection:
  ✓ namespace.yaml — matches
  ✓ rbac.yaml — matches
  ⚠ agent-pod.yaml — drift detected:
    - Image tag: expected v1.0.0, found v0.9.0
    - Memory limit: expected 512Mi, found 256Mi

flag

Auto-remediate fixable vulnerabilities by updating dependencies.

hexr audit --fix

What Gets Audited

Check	Tool	Description
Python dependencies	`pip-audit`	Known CVEs in installed packages
SBOM generation	CycloneDX	Software bill of materials for compliance
Container image	Vulnerability scanner	OS-level vulnerabilities in base image
Manifest drift	`kubectl diff`	Deployed state vs. generated manifests

CLI Overview

Commands

Usage

Default Scan

Options

What Gets Audited

​Usage

​Default Scan

​Options

​What Gets Audited

Usage

Default Scan

Options

What Gets Audited