Merge pull request #83 from sonukapoor/feature/issue-82-readme-positioning

[Enhancement] Strengthen offline support positioning in the README

Author: sonukapoor

README.md

@@ -8,7 +8,7 @@
   <img src="https://github.com/sonukapoor/cve-lite-cli/blob/main/assets/logo-with-title.png" alt="CVE Lite CLI" width="320"/>
 
   <h1>CVE Lite CLI</h1>
-  <p>Fast, developer-friendly vulnerability scanning for JavaScript and TypeScript projects.</p>
+  <p>Fast, developer-friendly vulnerability scanning for JavaScript and TypeScript projects, with offline support for restricted environments.</p>
 
   <strong>Scan. Prioritize. Fix.</strong>
 
@@ -27,6 +27,13 @@
 
 **CVE Lite CLI** helps developers scan their projects for known package vulnerabilities without signing up for an expensive platform. It is built for the moment right before release, when you want a clear answer, a practical fix plan, and a tool you can actually afford to use.
 
+It is designed to be:
+
+- developer-friendly in day-to-day workflows
+- local-first and transparent about network behavior
+- usable in enterprise and restricted-network environments
+- capable of zero-runtime-network scans through a local advisory database
+
 ## New: Offline advisory DB support
 
 CVE Lite CLI now supports a local advisory database workflow for teams that cannot allow runtime outbound advisory API calls.
@@ -50,6 +57,19 @@ cve-lite /path/to/project --offline
 cve-lite /path/to/project --offline-db /path/to/advisories.db
 ```
 
+## Why offline mode matters
+
+For many teams, “works locally” is not enough. They also need a scanner that can fit into environments where runtime outbound calls are restricted, reviewed closely, or disallowed entirely.
+
+Offline advisory DB support makes CVE Lite CLI more practical for:
+
+- enterprise environments with strict network controls
+- regulated teams that need explicit advisory data handling
+- internal CI systems that should not depend on public runtime API access
+- air-gapped or partially connected workflows
+
+This is one of the most important differentiators in the project today because it improves both trust and adoptability, not just convenience.
+
 ## Quick start
 
 Install globally:
@@ -108,6 +128,34 @@ cve-lite /path/to/project --offline
 cve-lite /path/to/project --offline-db /path/to/advisories.db
 ```
 
+## Workflow modes
+
+CVE Lite CLI now supports three clear advisory workflows:
+
+### 1. Standard online scan
+
+Use the default OSV-backed mode when runtime advisory API access is acceptable:
+
+```bash
+cve-lite /path/to/project
+```
+
+### 2. Advisory DB sync
+
+Build or refresh the local advisory database ahead of time:
+
+```bash
+cve-lite advisories sync
+```
+
+### 3. Offline local DB scan
+
+Scan against the local advisory DB with zero runtime advisory API calls:
+
+```bash
+cve-lite /path/to/project --offline
+```
+
 ## What it looks like
 
 CVE Lite CLI produces a clean, summary-first console view by default, designed for fast triage before release.
@@ -197,6 +245,8 @@ Its role is narrower and workflow-focused:
 
 This section is here to make the scope clear. CVE Lite CLI aims to complement the broader security ecosystem by being a practical, low-friction option for JS/TS dependency checks close to release time.
 
+One of the clearest examples of that focus is offline support: CVE Lite CLI is built to let teams explicitly sync advisory data and then scan locally, instead of forcing every environment to depend on runtime outbound vulnerability API access.
+
 ## Network behavior and privacy
 
 CVE Lite CLI is a local-first scanner. It parses dependency information locally, uses local caching to reduce repeated lookups, and in standard mode queries OSV for advisory data needed for matching. It also now supports a local advisory database workflow for offline scans with zero runtime advisory API calls.
@@ -315,6 +365,8 @@ CVE Lite CLI is designed as a **local-first, metadata-only** scanner. Unlike tra
   It reads your project locally and uses package/version matching against OSV advisories.
 - **offline-capable**
   It can sync and scan against a local advisory database for zero-runtime-network workflows.
+- **enterprise-friendly network model**
+  Teams can control when advisory data is synced and where offline scans run, which is valuable in restricted environments.
 - **release-focused**  
   It is especially useful before a release, in CI, or during final dependency cleanup.
 
@@ -430,6 +482,7 @@ CVE Lite CLI is a good fit for:
 - developers who want a second opinion alongside other tools
 - OSS maintainers who need a practical scan before publishing
 - teams that need offline or controlled-network dependency scanning
+- security-conscious organizations that need clear advisory data control
 
 ## Supported workflows
 
@@ -507,6 +560,16 @@ Compared with other tools in this space, CVE Lite CLI focuses on:
 | Snyk CLI | Broader enterprise security workflows | Broad | Strong ecosystem coverage | Strong commercial guidance | Strong | Teams adopting a larger security platform |
 | Socket CLI | Broader package and supply-chain risk visibility | Broad | Multi-ecosystem/package-risk focus | Strong for package risk workflows | Strong | Teams that want more than CVE scanning alone |
 
+### Offline support at a glance
+
+| Tool | Local advisory DB workflow | Zero runtime advisory API calls |
+|---|---|---|
+| **CVE Lite CLI** | **Yes** | **Yes** |
+| `npm audit` | No built-in local advisory DB workflow | No |
+| OSV-Scanner | Depends on broader workflow setup rather than the local DB pattern emphasized here | Varies by setup |
+| Snyk CLI | Not the primary workflow emphasis | Varies by product/workflow |
+| Socket CLI | Not the primary workflow emphasis | Varies by product/workflow |
+
 ### CVE Lite CLI vs npm audit
 
 `npm audit` is the built-in default for npm users, which makes it convenient when your workflow is entirely npm-based.
@@ -527,6 +590,7 @@ CVE Lite CLI stands out when you want:
 - a narrower, easier-to-understand tool built specifically around JS/TS dependency workflows
 - remediation-first output instead of a more general multi-ecosystem scanner experience
 - a more approachable local workflow for everyday developers
+- a more explicit local advisory DB workflow for offline or restricted environments
 
 ### CVE Lite CLI vs Snyk CLI
 
@@ -537,6 +601,7 @@ CVE Lite CLI stands out when you want:
 - a simpler and lighter dependency CVE workflow
 - an affordable option for small teams, startups, consultants, and independent developers
 - a focused tool for lockfile-based release checks without adopting a larger platform
+- a more explicit offline scanning model with local advisory DB control
 
 ### CVE Lite CLI vs Socket CLI