Building a Better Database: How GitHub Structures Their Advisory Database to Drive Developer ...
summary
GitHub structures an advisory database indexed by package ecosystem (not CPE) so scanners can match artifacts deterministically, power Dependabot to open and merge security PRs, and aim for zero false positives by package matching while admitting lossy context. A live rollout on log4j shows a 12-hour half-life from 100% to ~50% vulnerable downloads (Sonatype), data is public in OSV format, and gaps remain (e.g., Maven registry distinction, C/C++ packaging).
AI-written summary · about
chapters (11)
- 0:00GitHub’s Advisory Database intro
- 1:02Goals and challenges
- 3:34No CPE for advisory matching
- 7:24Matching vulnerabilities to code
- 9:30Dependabot’s security bridge
- 10:35Impact of Dependabot alerts
- 11:59Security updates trends
- 13:05Open data and contributions
- 14:50Limitations and future
- 15:32Improving advisory accuracy
- 17:39Q&A: GHSA vs NVD vs CPE
related talks
30mSecuring the software supply chain together
38mFortifying Your Codebase with GitHub
32mA Vulnerability Database Should Not Be About Vulnerabilities!
41mBake Security into your workflow with GitHub Advanced Security and AI
31mA Glimpse Into OSS Vulnerability Disclosure Practices
19mFlipping the script on application security
27mBuilding a Secure Open Source Project on GitHub
21mOpen source security: advisories and workflows to keep open source secure