This connector is a small, out-of-process job you run beside your Dependency-Track instance. It holds two credentials, so its data flow deserves a precise statement. It is small on purpose — read the source (dt_vex_sync/) and verify all of the below.

Per cycle:

KernelScan (--kscan-url, default https://kernelscan.io), authenticated with your ks_live_… Bearer key — the same account key the analyzer plugin uses:

• GET /api/products — resolve which of your own products matches a project.
• GET /api/products/{id}/vex — fetch that product's config-aware VEX.

Dependency-Track (--dt-url), authenticated with an X-Api-Key team key:

• GET /api/v1/project — list projects to sync.
• GET /api/v1/bom/cyclonedx/project/{uuid} — read the kernel component + its optional kernelscan:product binding, to resolve the product.
• PUT /api/v1/vex — import the VEX (the config-aware verdicts) into the project.

That is the complete network surface.

• It does not send your DT SBOMs, components, or findings to KernelScan. It reads a project's BOM from your DT only to read the kernel version and the kernelscan:product property locally; nothing from DT is forwarded to KernelScan. The only DT-derived value influencing a KernelScan request is the kernel version string (to select a product you already registered).
• It opens no listeners, spawns no processes, and writes only its state file (--state-file, default /data/dt-vex-sync-state.json) — a per-project record of the last VEX ETag pushed, used for change-detection.

• Supplied via environment only. Both keys are read from the environment (DT_API_KEY, KSCAN_API_KEY) or, better, from a file the environment points at (DT_API_KEY_FILE, KSCAN_API_KEY_FILE — the Docker/systemd/k8s secrets convention). They are never accepted as command-line flags: argv is world-readable via ps and docker inspect, so the tool refuses that path.
• KernelScan key: an account API key (ks_live_…); the /api/products endpoints are user-scoped, so it only ever sees your own products.
• DT key: a team API key scoped to VIEW_PORTFOLIO (list projects, export BOM) + VULNERABILITY_ANALYSIS (import VEX). No admin login is used.
• The tool logs request URLs at INFO but never the Authorization / X-Api-Key headers or key values.

Per-project failures (a project with no matching product, an unreachable DT export, a rejected VEX) are logged and skipped — one bad project never aborts the rest of the cycle, and a KernelScan outage aborts only the current cycle, not the loop. The connector only adds analysis decisions via VEX import; it never deletes findings or projects.

Please report security issues privately to support@kernelscan.io rather than opening a public issue. We aim to acknowledge within 3 business days.