Security Guides

Withdrawn, rejected or disputed: what does each advisory label mean?

Withdrawn, rejected and disputed are three different states in OSV, GitHub and CVE data. Learn which ones to hide from findings and which to keep and review.

Can you add KEV and EPSS to an open source scanner yourself?

Yes, both KEV and EPSS are free to download. What the integration involves, what it does not fix, and when a managed platform saves the effort.

Do WIP limits help clear a security fix queue?

Limiting work in progress helps clear a security fix queue by forcing fixes to finish. Here is how to set the limit, handle urgent items and spot blockers.

Will your software vendor tell you when its product has a flaw?

How to make sure a vendor tells you about vulnerabilities in what you bought: advisory channels, CVE quality, a disclosure policy and contract wording.

Will old hashes and encrypted data survive a crypto library upgrade?

Before merging a cryptography library fix, test that existing password hashes, ciphertext and signatures still verify. A checklist with a decision table.

Will CI log masking hide a Google Play JSON key?

Log masking matches exact strings, so a whole JSON key file is a poor fit. How to store and use a Play service account key so it does not leak into logs.

Why do two security scanners report different findings on one app?

Two scanners can both be right and still disagree. Five causes, from different vantage points to different data, and a way to reconcile the lists.

Why do two Python versions appear in one container scan?

Non-slim Python images carry a distro Python and an image Python. Each has its own findings and its own fix. Here is how to tell them apart.

Why do two license scans of the same project give different results?

Two license scans can differ because of scope, evidence source, version matching and naming. Compare those four before deciding which report is right.

Why is there no Debian advisory for a CVE my scanner flagged?

Debian does not issue a DSA for every CVE. Learn how to read the Security Tracker, what dsa-needed means and what to tell your auditor about the finding.

Why does the same code get different reachability results per build?

Build flags, platforms and versions change which code is compiled, so reachability can differ between builds. Here is how to make results comparable.

Why does SLA compliance look great when you count only closed items?

If SLA compliance includes only closed findings, the slowest items are missing and the number is inflated. Include open overdue items for a fair rate.