Spend 30 minutes a week reading three real advisories for software you could actually use, trace the fix for one, and write two sentences about each. After two months you will recognize weakness patterns, understand version ranges, and have a log that doubles as portfolio evidence.
The routine
| Minutes | Activity |
|---|---|
| 0 to 5 | Pick three advisories from a public source |
| 5 to 15 | Read each: package, affected range, patched version, impact |
| 15 to 25 | Open the fix commit or release notes for one and read the diff |
| 25 to 30 | Write two sentences per advisory in your log |
Where to find advisories
- The GitHub Advisory Database, which covers ecosystems including npm, PyPI, Maven, Go, NuGet, RubyGems and Rust crates. GitHub-reviewed advisories are checked for validity and completeness.
- OSV, which aggregates databases that use the OpenSSF vulnerability format.
- CISA's Known Exploited Vulnerabilities catalog for issues with observed exploitation.
Prefer reviewed entries when you are learning, since the data is more complete.
What to write in the log
Keep it short and consistent.
- The package and ecosystem.
- The weakness in your own words, for example, user input reaches a file path without checks.
- The fix in one sentence.
- One question you still have.
The questions are the valuable part. Revisit them monthly, and you will see which ones you can now answer.
How to read the fix
The fix diff is where learning happens. Look for what the maintainers added: a check, an encoding step, a stricter parser, a removed feature. Ask whether the fix addresses the cause or only the example in the report. Ask what test they added. If the project is one you use, that is also your upgrade plan.
Watch for patterns
After a few weeks, you will notice repeats: path handling, deserialization, missing authorization checks, parsing edge cases. Map each to the OWASP Top 10 2025 category it belongs to, such as Broken Access Control or Injection. That gives you vocabulary, and it shows how often the same mistakes recur.
Measure progress
- Can you decode a CVSS vector without a lookup? See how to read a CVSS vector string.
- Can you tell whether a version you run is affected within two minutes?
- Can you explain why a high score might not matter for a given app?
Publish the log in a public repository when it has a dozen entries. Avoid adding anything about systems you do not own or any unfixed flaw you found yourself.
Quick check
Do I need to code to follow this routine?
Reading code helps, but you can start by reading advisories and release notes and add code reading as you grow.
Should I read old or new advisories?
Mix both. Older ones have clear fixes and write-ups, newer ones teach you what is current.
Sources
- GitHub Docs: About the GitHub Advisory Database
- OSV documentation
- CISA Known Exploited Vulnerabilities Catalog
- OWASP Top 10:2025
Last reviewed: 19 October 2026.
