A security finding should tell you where it came from, why it matches, and what you have done about it.
Reported package vulnerability
example-package@1.2.37e4c8a1 · mainThen follow the linked maintainer guidance and record what changed.
Connect GitHub or GitLab.com, or upload a supported inventory. Review exact package versions and warnings before you assess. A repository import retains the branch, inventory path, and commit behind the snapshot.
Understand inventory scopeSeverity explains the reported issue. Known exploitation and EPSS bring different kinds of evidence. The inventory match identifies software worth investigating. Check source status and collection times beside the record.
Understand the evidenceMove from Open to Investigating, record a mitigation, or close as Resolved or Not affected with written evidence. Activity keeps the decision and response together. Closure records your attestation; it does not independently verify a deployment.
Work through a findingThe current workflow assesses npm and PyPI package metadata. A shared lockfile can cover an entire repository. A successful scan does not establish deployed exposure, code reachability, or a verified fix.
Provider access, inventory sync, advisory collection, and response completion remain independent states. A failure stays visible alongside the last successful evidence.
Read about freshness and failuresStart with a repository or a pinned inventory.