Issues

• ci: check commit signatures and DCO sign-off

  good first issuepriority/high
  venslabs/vens#398 · Filter by author fahedouch opened on Nov 4, 2026

• debug-dir: old run folders pile up

  venslabs/vens#397 · Filter by author fahedouch opened on Nov 4, 2026

• Document how a scan is scored

  venslabs/vens#374 · Filter by author fahedouch opened on Oct 19, 2026

• Share the temperature refuse-list across providers

  go
  venslabs/vens#351 · Filter by author fahedouch opened on Oct 12, 2026

• Impact is a per-project constant, so the 3x3 matrix collapses to one row

  bugpriority/highstatus/needs-design-discussion
  venslabs/vens#340 · Filter by author fahedouch opened on Oct 8, 2026

• A vulnerability the model did not score is published as info

  buggopriority/high
  venslabs/vens#337 · Filter by author fahedouch opened on Oct 7, 2026

• Could vens assert not_affected itself?

  enhancementstatus/needs-design-discussion
  venslabs/vens#333 · Filter by author fahedouch opened on Oct 6, 2026

• Look at SSVC's decision tree before we settle the scoring rules

  enhancementstatus/needs-design-discussion
  venslabs/vens#332 · Filter by author fahedouch opened on Oct 5, 2026

• Multi-component CVE: the published score depends on --llm-batch-size

  buggopriority/high
  venslabs/vens#327 · Filter by author fahedouch opened on Oct 3, 2026
  1

• Ease of Discovery and Ease of Exploit: EPSS and KEV are both in the Grype input, neither is in Trivy's

  enhancementkind/benchmarkpriority/mediumstatus/needs-design-discussion
  venslabs/vens#326 · Filter by author fahedouch opened on Oct 3, 2026
  1

• Carry the three OWASP scores and a method version in vulnerabilities[].properties

  enhancementpriority/lowstatus/needs-design-discussion
  venslabs/vens#325 · Filter by author fahedouch opened on Oct 3, 2026

• The reasoning is invisible in Dependency-Track

  Dependency-Trackenhancementstatus/needs-design-discussion
  venslabs/vens#316 · Filter by author fahedouch opened on Sep 26, 2026

• Rework the scoring so the vector is legal, the score is not distorted, and the spread across models stays within a measured bound

  kind/benchmarkpriority/highstatus/needs-design-discussion
  venslabs/vens#310 · Filter by author fahedouch opened on Sep 20, 2026
  29

• LLM never sees the CVSS vector, so it cannot apply the attack-vector rule the prompt asks for

  venslabs/vens#297 · Filter by author fahedouch opened on Sep 10, 2026
  1

• Budget gate for LLM spend (--max-spend)

  enhancement
  venslabs/vens#206 · Filter by author fahedouch opened on Jul 16, 2026
  1

• Nightly CI smoke test against the real LLM providers

  enhancementpriority/medium
  venslabs/vens#175 · Filter by author fahedouch opened on Jul 2, 2026
  1

• Sign the CDXA attestation (--attest)

  enhancement
  venslabs/vens#162 · Filter by author fahedouch opened on Jun 17, 2026
  3

  

• Verify trivy binary signature before invocation

  enhancementgohelp wanted
  venslabs/vens#139 · Filter by author fahedouch opened on May 13, 2026
  1

• Async-batch mode using Anthropic Message Batches / OpenAI Batch API

  enhancementgohelp wantedstatus/needs-design-discussion
  venslabs/vens#125 · Filter by author fahedouch opened on Apr 27, 2026

• Route scan output to slack / jira / linear instead of just a VEX file

  enhancementhelp wantedstatus/needs-design-discussion
  venslabs/vens#124 · Filter by author fahedouch opened on Apr 27, 2026
  2

• Add GitLab CI runner alongside the GitHub Action

  enhancementgohelp wantedstatus/needs-design-discussion
  venslabs/vens#122 · Filter by author fahedouch opened on Apr 27, 2026

• Add interactive CLI command to generate context config.yaml

  enhancement
  venslabs/vens#88 · Filter by author fahedouch opened on Mar 18, 2026

• Implement community score engine

  venslabs/vens#10 · Filter by author fahedouch opened on Nov 2, 2025