Nuclei Integration Guide

Integrate Nuclei with Vulnetix. Scan web applications and infrastructure using thousands of community-maintained templates with SARIF export.

Install & scan

$ go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
$ nuclei -u https://example.com -se nuclei.sarif

Run Nuclei in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Nuclei
  run: go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
- name: Run Nuclei
  run: nuclei -u https://${{ env.TARGET_URL }} -severity critical,high -se nuclei.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: nuclei
    path: nuclei.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Nuclei's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Nuclei. Keep running it. Vulnetix sits on top of Nuclei (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Nuclei is strongest at its core category and also carries features in Network & Vulnerability Scanners, Cloud Security & CSPM, Fuzzing, Container & Image Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Nuclei does well

• Huge community-curated template library (9,000+ YAML templates, approaching 10,000) covering CVEs, misconfigurations, exposures and default credentials, with new CVE templates often appearing within hours of disclosure
• Simple, transparent YAML DSL: each template encodes exact request/matcher logic, so detections are auditable and easy to author or customise
• Multi-protocol reach (HTTP, DNS, TCP, SSL, WebSocket and headless-browser) spanning apps, APIs, networks, DNS and cloud configurations
• Extremely fast at scale and increasingly DAST-capable (fuzzing templates for SQLi/XSS/RCE, AI-assisted template generation)

Where Vulnetix adds to it: Nuclei is an active template-based scanner that sends live probes at targets. Vulnetix has NO native DAST/network/fuzzing engine and does not run these checks itself. Better-together: Vulnetix ingests Nuclei's findings, deduplicates them against SAST/SCA/container/IaC/secret results into one prioritised queue, and adds the prioritisation and governance layer Nuclei omits (EPSS + CISA KEV + Coalition ESS + CWSS + LEV, reachability, SSVC, immutable versioned VEX, EOL policy, Safe Harbour autofix). Nuclei stays the engine that performs the dynamic detection.

No migration, no rip-and-replace. Nuclei keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Nuclei results in Vulnetix

Upload Nuclei SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Nuclei documentation ↗  ·  Source repository ↗

Wire Nuclei into your CI/CD pipeline →