Read a scan report left to right as a chain of questions: what is the flaw, which package and version, is there a fixed version, how severe is it, how does it get into your code, and is anyone exploiting it. Most reports contain these columns under different names, and each answers one question.
Column guide
| Column | What it answers | How to use it |
|---|---|---|
| ID | Which flaw is this? | Look up aliases, since one flaw may have several IDs |
| Package and ecosystem | Which component? | Confirm it is really in your product |
| Installed version | What do we run? | Compare with the affected range |
| Fixed version | Is there a fix to move to? | If blank, plan a mitigation instead |
| Severity | How bad in general? | A starting point, not a decision |
| Dependency path | Direct or transitive? | Tells you which parent to upgrade |
| Reachable | Is the code called? | Raises or lowers urgency |
| Exploited | Known exploitation? | Membership in the CISA exploited list means act first |
| Scope | Dev or runtime? | Dev only findings usually matter less |
A five minute triage routine
- Sort by exploited first, then by severity.
- For each top item, check that the installed version is really inside the affected range.
- Look at the dependency path. If transitive, find the parent that brings it in.
- Check the fixed version. If one exists and the jump is small, queue it for a fix pull request.
- Mark the rest: scheduled, accepted with reason, or not affected with reason.
Things that trip people up
- Duplicates. The same flaw can appear under several IDs and in several paths. Group before you count.
- Blank fixed version. This can mean no fix, or that the advisory lacks the data. Read the advisory.
- Severity inflation. Severity is general. A high severity flaw in unreachable code can matter less than a medium one in an exposed path.
- Stale reports. A report is a snapshot. New advisories change the answer without any change to your code.
What to record
For each decision: who, when, why, and what would change it. That record is also useful evidence for audits.
Quick check
Should I fix in severity order?
Severity is a reasonable first sort, but exploitation signals and reachability should move items up or down.
What does a blank fixed version mean?
Either no fix exists yet or the advisory does not record one. Check the advisory and the maintainer's releases before deciding on a mitigation.
Where Safeguard fits
Safeguard's dependency scanning reports these columns and adds reachability analysis. Run a free scan and read your own report with this guide.
Sources
- OSV schema, ossf.github.io/osv-schema (fixed events and aliases).
- CISA Known Exploited Vulnerabilities Catalog.
Last reviewed: 19 October 2026.
