@@ -6,14 +6,16 @@ nav_order: 1
6
6
7
7
[ ![ OpenSSF Scorecard] ( https://api.securityscorecards.dev/projects/github.com/google/osv.dev/badge )] ( https://api.securityscorecards.dev/projects/github.com/google/osv.dev )
8
8
9
- [ osv.dev] ( https://osv.dev ) is a [ vulnerability database] ( https://osv.dev/list )
10
- and triage infrastructure for open source projects aimed at helping both open
11
- source maintainers and consumers of open source.
9
+ OSV enables developers to identify known third-party open source dependency
10
+ vulnerabilities that pose genuine risk to their application and its environment,
11
+ so they can focus remediation efforts on the vulnerabilities that matter and
12
+ sustainably manage vulnerabilities that do not affect them.
12
13
13
14
[ This repository] ( https://github.com/google/osv.dev ) contains the infrastructure
14
- code that serves [ osv.dev] ( https://osv.dev ) (and other user tooling). This
15
- infrastructure serves as an aggregator of vulnerability databases that have
16
- adopted the [ OpenSSF Vulnerability format] ( https://github.com/ossf/osv-schema ) .
15
+ code that serves [ osv.dev] ( https://osv.dev ) (including the
16
+ [ API] ( https://google.github.io/osv.dev/api/ ) ). This infrastructure serves as an
17
+ aggregator of vulnerability databases that have adopted the [ OpenSSF
18
+ Vulnerability format] ( https://github.com/ossf/osv-schema ) .
17
19
18
20
[ osv.dev] ( https://osv.dev ) additionally provides infrastructure to ensure
19
21
affected versions are accurately represented in each vulnerability entry,
@@ -22,6 +24,9 @@ through bisection and version analysis.
22
24
Further information on the infrastructure architecture is available
23
25
[ here] ( contributing/architecture.md ) .
24
26
27
+ [ OSV-Scanner] ( https://google.github.io/osv-scanner/ ) is the first-party tool
28
+ that leverages OSV.dev's data, using its API.
29
+
25
30
![ This is a diagram that shows the relationship between the vulnerability
26
31
databases that use the OSV format and how all those entries are collated at
27
32
OSV.dev. Open source users can query for known vulnerabilities by version number
0 commit comments