add vex support

komodo/README.md

@@ -142,6 +142,7 @@ Edit the stack's `environment` (in the TOML or in Komodo) and re-apply the sync:
 | `NOTIFY_MIN_SEVERITY` | Lowest severity that sends an alert (default `HIGH`). |
 | `FAIL_ON` | Lowest severity that makes the container exit `1` (default `HIGH`). |
 | `IGNORE_UNFIXED` | `true` to ignore findings without a fix. |
+| `TRIVY_VEX` | VEX sources: `repo`, `oci`, `sbom-ref`, or local file paths (space separated). |
 | `MAX_FINDINGS_IN_BODY` | Findings listed per notification. |
 
 Schedule fields are on the Procedure:
@@ -168,6 +169,10 @@ Private registries: add `TRIVY_USERNAME`, `TRIVY_PASSWORD` and optionally
 `TRIVY_INSECURE` to the stack environment. The Compose file already passes
 them through to the container.
 
+VEX: set `TRIVY_VEX = repo`, `oci` or a combination in the stack environment.
+For local files, add `- ./vex:/vex:ro` to the `vulnscan` service volumes in
+`docker-compose.yml` and use a path such as `TRIVY_VEX = /vex/app.json`.
+
 ## Troubleshooting
 
 | Symptom | Fix |