> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# hexr audit

> Security audit: vulnerability scanning, SBOM generation, and manifest drift detection for your deployed agents.

## Usage

```bash theme={null}
hexr audit [options]
```

***

## Default Scan

```bash theme={null}
$ hexr audit

╔═══════════════════════════════════════════════════╗
║              Hexr Security Audit                   ║
╚═══════════════════════════════════════════════════╝

[1/3] Dependency Vulnerabilities (pip-audit)
  ✓ Scanned 47 packages
  ⚠  2 vulnerabilities found:
     • requests 2.31.0 → CVE-2024-xxxxx (Medium) — fix: 2.32.0
     • cryptography 41.0.0 → CVE-2024-xxxxx (Low) — fix: 42.0.0

[2/3] SBOM Generation (CycloneDX)
  ✓ Generated CycloneDX SBOM
  ✓ 47 components cataloged

[3/3] Container Image Scan
  ✓ Base image: python:3.11-slim
  ✓ 0 critical, 0 high vulnerabilities
  
Summary: 2 medium/low issues. No critical risks.
```

***

## Options

<ParamField path="--export <file>" type="path">
  Export CycloneDX SBOM to a file.

  ```bash theme={null}
  hexr audit --export sbom.json
  ```
</ParamField>

<ParamField path="--verify" type="flag">
  Verify that deployed Kubernetes state matches generated manifests (drift detection).

  ```bash theme={null}
  $ hexr audit --verify

  Drift Detection:
    ✓ namespace.yaml — matches
    ✓ rbac.yaml — matches
    ⚠ agent-pod.yaml — drift detected:
      - Image tag: expected v1.0.0, found v0.9.0
      - Memory limit: expected 512Mi, found 256Mi
  ```
</ParamField>

<ParamField path="--fix" type="flag">
  Auto-remediate fixable vulnerabilities by updating dependencies.

  ```bash theme={null}
  hexr audit --fix
  ```
</ParamField>

***

## What Gets Audited

| Check                   | Tool                  | Description                               |
| ----------------------- | --------------------- | ----------------------------------------- |
| **Python dependencies** | `pip-audit`           | Known CVEs in installed packages          |
| **SBOM generation**     | CycloneDX             | Software bill of materials for compliance |
| **Container image**     | Vulnerability scanner | OS-level vulnerabilities in base image    |
| **Manifest drift**      | `kubectl diff`        | Deployed state vs. generated manifests    |