> ## Documentation Index
> Fetch the complete documentation index at: https://bun.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://bun.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://bun.manicule.dev/api/mcp.
> Every agent surface: https://bun.manicule.dev/.well-known/llms-manifest.json

# bun audit (/pm/cli/audit)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 451 · updated: 2026-08-02 -->
Related: [bun publish](/pm/cli/publish.md), [bun outdated](/pm/cli/outdated.md), [bun why](/pm/cli/why.md), [bun info](/pm/cli/info.md)

> Check your installed packages for known security vulnerabilities

Run the command in a project with a `bun.lock` file:

```bash icon="terminal" title="terminal" terminal
bun audit
```

Bun sends the list of installed packages and versions to npm, and prints a report of any vulnerabilities found. Packages installed from registries other than the default registry are skipped.

If no vulnerabilities are found, the command prints:

```
No vulnerabilities found
```

When vulnerabilities are detected, Bun lists each affected package with the severity, a short description, and a link to the advisory. At the end of the report it prints a summary and hints for updating:

```
3 vulnerabilities (1 high, 2 moderate)
To update all dependencies to the latest compatible versions:
  bun update
To update all dependencies to the latest versions (including breaking changes):
  bun update --latest
```

### Filtering options

**`--audit-level=<low|moderate|high|critical>`** - Only show vulnerabilities at this severity level or higher:

```bash icon="terminal" title="terminal" terminal
bun audit --audit-level=high
```

**`--prod`** - Audit only production dependencies (excludes devDependencies):

```bash icon="terminal" title="terminal" terminal
bun audit --prod
```

**`--ignore <CVE>`** - Ignore specific CVEs (repeat the flag to ignore several):

```bash icon="terminal" title="terminal" terminal
bun audit --ignore CVE-2022-25883 --ignore CVE-2023-26136
```

### `--json`

Use the `--json` flag to print the raw JSON response from the registry instead of the formatted report:

```bash icon="terminal" title="terminal" terminal
bun audit --json
```

### Exit code

`bun audit` exits with code `0` if no vulnerabilities are found and `1` if the report lists any, including when `--json` is passed.