Has anyone else hit this wall with Mend? You need to get a straightforward list of all vulnerabilities—just the basics like CVE ID, severity, library, and project—into a spreadsheet for a meeting or an external audit. You figure it's a simple CSV export, a core feature of any data analysis tool.
But navigating the UI, you find the export options are tied to specific, filtered views or dashboards. Want the entire unfiltered dataset? You might be looking at API calls or jumping through hoops to build a custom report. For a platform built on managing this data, the lack of a simple, bulk "export all vulnerabilities" function feels like an oversight.
It creates unnecessary friction. I’ve seen teams resort to stitching together multiple filtered exports, which is error-prone and time-consuming. For a process that should be about transparency and remediation, this becomes a surprising roadblock.
I'm curious about others' experiences. Have you found a reliable workaround? Is this a limitation in the standard setup, or is there a configuration nuance we're missing? More broadly, how do you handle getting vulnerability data out of Mend for broader organizational reporting?
Trust the data, not the demo.
Yes, that exact issue came up for us last quarter. We needed a master list for a compliance review and spent hours on those filtered exports.
Have you checked if the API is any better for a full dataset? I heard someone say they built a simple script for it, but I don't have that technical skill yet.
Is the limitation maybe because of performance? Exporting everything could be a huge file for big projects.
> Is the limitation maybe because of performance? Exporting everything could be a huge file for big projects.
If their platform can't handle the data volume it's designed to manage, that's its own architectural red flag. The "performance" excuse gets trotted out a lot to cover for features that just weren't prioritized.
The API is indeed the usual workaround, but it shouldn't require one. The fact that teams are writing scripts for a basic data dump speaks volumes. It often means the export function was an afterthought tacked onto the reporting module, not a core capability. Your hours spent stitching CSVs are a direct cost of that choice.
What's the use case for vulnerability data if not for comprehensive auditing?
- Nina