Security Guides

Why am I still exposed after a security fix is released?

A fix existing is not the same as the fix being installed. The gap between release and install is where most real exposure sits. Here is how to shrink it.

Why do AI-built frontends leak API keys through env variables?

Frontend build tools copy prefixed env variables into browser code, so a secret in a prefixed variable is public. Learn the rule and how to fix it.

Why is accuracy the wrong way to judge a vulnerability score?

A rule predicting no exploitation scores 97 to 98 percent accuracy. FIRST uses coverage, effort and efficiency instead. How to test any prioritization rule.

Why a year of skipped updates makes the next emergency patch slower

The patch is rarely the slow part. A year of skipped updates means upgrades must come first. Here is why emergency fixes stall and what shortens them.

Why can a skipped security check still let a pull request merge?

On GitHub, skipped and neutral count as passing for required checks. Learn when a security job skips, why that matters for forks, and how to close the gap.

Why does a scanner show a different severity than the advisory?

Severity can differ because of scoring version, publisher, metric groups or tool rules. Learn the five causes and how to compare scores fairly.

Why does a reachability verdict need a commit and a date?

A reachability result describes one build at one moment. Why auditors want the commit, tool version and date beside it, and a minimal record format.

Why does a new CVE show no severity score? NVD enrichment explained

A CVE can be public with no score or package mapping because NVD enrichment is prioritised. Learn what to do while the data is missing from the record.

Why does a container scan report a package you deleted?

Container images are stacked layers, so a file deleted in a later layer still sits in an earlier one. Learn why scans flag it and how to fix the build.

Who should a vendor notify first after an SBOM match?

After an SBOM shows an affected component, notify in order of exposure and ability to act. A tiering model, message content and a timing table for vendors.

Who supports an open source component in production? Three options

Buy support from a vendor, rely on the community, or accept the risk. The OSPO book says to decide deliberately before a component reaches production.

Who should sign off a not reachable decision, and what do they need?

A not reachable label should have an owner, evidence and a recheck trigger. Here is who signs off, what they review, and a simple template to use.