Check two things separately: whether the code is maintained and whether its advisory data is fresh. Commits can be frequent while the database your scanner reads is a stale snapshot. Test with a recent, known advisory and see whether the scanner reports it, and when.
Two clocks, not one
Maintenance signals describe the program. The OpenSSF Scorecard Maintained check, for example, looks at commits in the last 90 days and recent issue activity from project members. That says the program is being worked on.
It does not say the data behind it is current. A scanner can download a database at install time, bundle one in a container image, or fetch it live. Each approach has a different freshness story.
How data reaches a scanner
| Model | How it works | Freshness risk |
|---|---|---|
| Live fetch | Queries a service at scan time | Network or service outage |
| Cached download | Downloads and stores for a period | Cache older than you think |
| Bundled snapshot | Ships inside the release or image | Only as fresh as the release |
| Manual import | You load a file | Only as fresh as your last import |
A bundled snapshot in a pinned image is a common cause of stale results. You did the right thing by pinning the tool, and as a side effect froze the data.
A simple freshness test
- Pick an advisory published in the past few days for a package in an ecosystem you use. Use a public database to find one.
- Create a small test project that depends on an affected version, in a scratch repository.
- Run your scanner as your CI would, with the same cache and image.
- See if it reports the advisory. If not, note the date and run again later.
- Record how many days passed between publication and your scanner reporting it.
Our guide to measuring advisory to alert time covers this in more detail. Use a throwaway project, not production code.
If the data is stale
Look at where in the chain the delay occurs:
- Database side. The advisory is not yet in the source your scanner reads. Wait, or add a second source.
- Scanner cache. The scanner has the data but your cache is old. Shorten the refresh interval or clear it.
- Pinned image. Update the image on a schedule, separately from the tool version.
- Matching. The data is present but the version range or name is not matched. Report it to the project.
Put it on a schedule
Run the freshness check monthly, or after any change to caching or images. If results are consistently slow, that is a concrete reason to look at other options. Safeguard's continuous monitoring and zero-day discovery are built for teams that need fresher signals without tending a data pipeline, and you can compare against a free scan at https://gold.safeguard.sh/scan.
Quick check
Does an active repository guarantee fresh results?
No. Activity describes the code. Freshness describes the data, and they can diverge.
How often should I test freshness?
Monthly is a reasonable default, and again after any change to caches or images.
Sources
- OpenSSF Scorecard, Checks documentation
Last reviewed: 19 October 2026.
