Your first scan

Scan a local directory, read the report, and understand what the scanner actually checked.

Unatazama toleo 0.0.1. Toleo jipya zaidi ni 0.0.2.

Tazama 0.0.2

By the end of this tutorial you will have scanned a real project, read a report, and — more importantly — know what the scanner did not check.

You need ZTVS 0.0.1 installed and a project directory to point it at.

Install#

cargo install ztvs --version 0.0.1
ztvs --version

You should see ztvs 0.0.1.

Scan something#

Point it at any project with a lockfile:

ztvs scan ./my-project

The first run takes a moment while the vulnerability database downloads. After that you will see something like:

  scanning ./my-project
  resolved 412 packages from 3 sources
  matched 7 advisories

  HIGH    RUSTSEC-2026-0031  openssl 0.10.55  → 0.10.66
  MEDIUM  RUSTSEC-2026-0044  time 0.3.20      → 0.3.36
  …

Read the report properly#

The summary is not the report. Ask for the full one:

ztvs scan ./my-project --format json > report.json

Every finding carries the evidence that produced it:

{
  "advisory": "RUSTSEC-2026-0031",
  "severity": "high",
  "package": { "name": "openssl", "version": "0.10.55" },
  "evidence": {
    "source": "lockfile",
    "path": "Cargo.lock",
    "line": 284
  }
}

That evidence block is the point. A finding without evidence is a rumour, and in 0.0.1 every finding has one.

What this did not check#

Worth being clear about, because it is the gap the next version closes:

  • It read your lockfile. It did not verify that the binaries on disk match it.
  • It scanned once. Nothing here notices that a new advisory landed tomorrow.
  • The report is unsigned. Anyone downstream has to trust that you ran the scan.

Next#

  • Scan a container image instead of a directory — see the how-to guides
  • Understand why evidence is attached to every finding — see Explanation