Security centre
Security status is tracked separately from funding and maintenance, per project and here across the platform. Findings carry deadlines from the project's SLA; deviations are documented exceptions.
Findings across all projects
- Open findings
- 1
- Past deadline
- 0
- Resolved in 30 days
- 0
- Active exceptions
- 0
- Published advisories
- 0
Open, by severity
- 0critical
- 0high
- 1medium
- 0low
Past the remediation deadline
- 0critical
- 0high
- 0medium
- 0low
Scanners only report vulnerabilities that are publicly known and that they can match to the packages they detect. “No known issues” is the result of those scans at that time, not a guarantee that the software is free of vulnerabilities.
Per-project findings, exceptions and scan history are on each project's security page. Projects with overdue issues
Scanners
Which scanners ran, and when one last succeeded. A scan is fresh only if at least one scanner succeeded.
| Scanner | Status | Last success |
|---|---|---|
| Trivy | Not configured | |
| Grype | Not configured | |
| OSV | Working |
Vulnerability feeds
EPSS, CISA KEV and OSV data used to enrich and re-match findings.
| Feed | Status | Last success |
|---|---|---|
| EPSS | Working | |
| CISA KEV | FailingKEV answered 403 Forbidden | — |
| OSV | Working | |
| NVD | Not configured | — |
Recent fixes
No finding was resolved recently.
Latest advisories
No advisory has been published.
Incidents
No public incident.