A scan result does not expire on its own, but its value decays. It is a snapshot taken against the advisory data available at that moment, so it can go out of date the day a new record appears. Treat every result as dated evidence, and set a freshness limit for each use.
Two clocks inside every result
A scan result carries two timestamps, even if the report shows only one.
- The scan time, which is when the inventory was read.
- The data time, which is how current the advisory database was when the comparison ran.
A report generated today from a database that last synced weeks ago is fresh in scan time and stale in data time. Ask for both. If a tool cannot tell you when its data was last updated, you cannot judge the result.
Why the data side moves
Advisory records are not static after publication. NVD states that it reanalyzes modified CVEs only when a change materially affects its enrichment data, which means some records change and others are left alone. Scores also shift: the FIRST project says EPSS is updated daily, so a priority ranking built from it can differ from one day to the next.
Pick a freshness limit by use
Different readers need different shelf lives. Here is a starting table you can adapt.
| Use of the result | Reasonable freshness limit |
|---|---|
| Blocking a pull request | Current data at the time of the check |
| Release approval | Same day as the release decision |
| Customer questionnaire | Dated, and refreshed before you send |
| Audit evidence | Dated sample, kept with the period it covers |
These limits are suggestions, not a standard. Choose values your team can actually meet.
Make staleness visible
Staleness is dangerous because it looks like safety. A green dashboard from three weeks ago still looks green.
- Show the data date next to every status.
- Turn a status grey, not green, once it passes the freshness limit.
- Alert when a scheduled scan has not run, so silence is never read as a pass.
- Keep old results for audit, but label them as historical.
Re-use is fine if you say so
You do not have to rescan before every conversation. Quoting last Tuesday's scan is honest when you say it is from last Tuesday. The mistake is presenting an old result as the present state.
Where Safeguard fits
Safeguard's dependency scanning records when a project was analysed, and its policies and gates can use current data at the point of a pull request. Try a free scan and note the timestamp on the result.
Quick check
Is a scan that found nothing proof of safety?
No. It shows that nothing matched the data available at that time. See a clean scan does not mean your software is safe.
What should a scanner tell me about its data?
At least which advisory sources it reads and when they were last updated. Without that, the result cannot be dated honestly.
Sources
Last reviewed: 19 October 2026.
