> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-d/08-8-open-source-vulnerability-databases-and-package-advisory-sources.md).

# 8. Open-source vulnerability databases & package advisory sources

## 8.1 OSV ecosystem

<table><thead><tr><th width="88.72265625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>OSV main site</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://osv.dev/">osv.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open data</td><td><strong><code>Relevance</code>:</strong> Aggregates OSS vulnerabilities by package ecosystem, version, commit, &#x26; aliases. Key for dependency-based detection.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> OSV is package/version- centric &#x26; often better than CPE for OSS packages. Coverage depends on upstream ecosystem feeds.</td></tr><tr><td align="right">2</td><td><strong>OSV vulnerability list</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://osv.dev/list">osv.dev/list</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Human-browsable OSV records.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for manual triage &#x26; ecosystem browsing. Prefer API/full downloads for automation.</td></tr><tr><td align="right">3</td><td><strong>OSV full database download</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/osv.dev/data/#full-database-download">google.github.io/osv.dev/data/#full-database-download</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open data</td><td><strong><code>Relevance</code>:</strong> Full database ZIP, including withdrawn records, via <code>gs://osv-vulnerabilities/all.zip</code>.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Best for local mirroring. Preserve withdrawn records for historical auditability.</td></tr><tr><td align="right">4</td><td><strong>OSV data sources page</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/osv.dev/data/">google.github.io/osv.dev/data</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Per-ecosystem downloads &#x26; full-database download.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for targeted ecosystem ingestion.</td></tr><tr><td align="right">5</td><td>OSV schema rendered spec</td><td><a href="https://ossf.github.io/osv-schema/">ossf.github.io/osv-schema</a></td></tr><tr><td align="right">6</td><td>OSV schema GitHub repo</td><td><a href="https://github.com/ossf/osv-schema">github.com/ossf/osv-schema</a></td></tr><tr><td align="right">7</td><td>OSV API docs</td><td><a href="https://google.github.io/osv.dev/post-v1-query/">google.github.io/osv.dev/post-v1-query</a></td></tr><tr><td align="right">8</td><td>OSV Scanner</td><td><a href="https://google.github.io/osv-scanner/">google.github.io/osv-scanner</a></td></tr><tr><td align="right">9</td><td>OSV Scanner GitHub</td><td><a href="https://github.com/google/osv-scanner">github.com/google/osv-scanner</a></td></tr><tr><td align="right">10</td><td>OSV ecosystem list</td><td><a href="https://osv.dev/list">osv.dev/list</a></td></tr><tr><td align="right">11</td><td>OSV.dev GitHub repository</td><td><a href="https://github.com/google/osv.dev">github.com/google/osv.dev</a></td></tr></tbody></table>

## 8.2 GitHub Advisory Database

<table><thead><tr><th width="87.21484375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>GitHub Advisory Database - web</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories">github.com/advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> GitHub-reviewed, unreviewed, malware, GHSA, &#x26; CVE advisory records across ecosystems.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> GHSA records can exist without CVEs. Preserve alias relationships between GHSA, CVE, &#x26; OSV.</td></tr><tr><td align="right">2</td><td><strong>GitHub Advisory Database repo</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/github/advisory-database">github.com/github/advisory-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Raw advisory data for local ingestion.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use for mirroring; validate ecosystem/version range semantics.</td></tr><tr><td align="right">3</td><td><strong>About GitHub Advisory Database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/about-the-github-advisory-database">docs.github.com/en/code-security/concepts/vulnerability-reporting-and- management/about-the-github-advisory-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Explains reviewed, unreviewed, &#x26; malware advisory model.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for confidence scoring. Reviewed vs unreviewed status affects dependability.</td></tr><tr><td align="right">4</td><td><strong>GitHub Security Advisory GraphQL object</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.github.com/en/graphql/reference/objects#securityadvisory">docs.github.com/en/graphql/reference/objects#securityadvisory</a><br><br><strong><code>Access / Cost</code>:</strong> Free docs; API usage may require GitHub auth token</td><td><strong><code>Relevance</code>:</strong> Programmatic advisory metadata access via GraphQL.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for complex filtered queries. Requires API authentication for robust use.</td></tr><tr><td align="right">5</td><td><strong>GitHub REST API - global security advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.github.com/en/rest/security-advisories/global-advisories">docs.github.com/en/rest/security-advisories/global-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public API; auth recommended for higher rate limits</td><td><strong><code>Relevance</code>:</strong> REST access for listing &#x26; retrieving global security advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Easier to integrate than GraphQL for many ingestion jobs.</td></tr><tr><td align="right">6</td><td><strong>GitHub REST API - security advisories root</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.github.com/en/rest/security-advisories">docs.github.com/en/rest/security-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs; some repository endpoints require permissions</td><td><strong><code>Relevance</code>:</strong> Root documentation for global &#x26; repository security advisory endpoints.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use to distinguish global advisories from repo-private advisories.</td></tr><tr><td align="right">7</td><td><strong>GitHub Dependabot alerts REST API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.github.com/en/rest/dependabot/alerts">docs.github.com/en/rest/dependabot/alerts</a><br><br><strong><code>Access / Cost</code>:</strong> Requires GitHub account, repository access, &#x26; relevant permissions</td><td><strong><code>Relevance</code>:</strong> Repository-specific vulnerability exposure from dependency graph.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Requires repo access. Useful for actual asset exposure, not just global vulnerability existence.</td></tr><tr><td align="right">8</td><td><strong>Dependabot supported ecosystems</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories">docs.github.com/en/code-security/reference/supply-chain- security/supported-ecosystems-and-repositories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Supported ecosystem list for GitHub dependency graph &#x26; alerts.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Coverage constraints impact blind spots in detection.</td></tr><tr><td align="right">9</td><td>GitHub malware advisories</td><td><a href="https://github.com/advisories?query=type%3Amalware">github.com/advisories?query=type%3Amalware</a></td></tr><tr><td align="right">10</td><td>GitHub npm advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Anpm">github.com/advisories?query=ecosystem%3Anpm</a></td></tr><tr><td align="right">11</td><td>GitHub pip advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Apip">github.com/advisories?query=ecosystem%3Apip</a></td></tr><tr><td align="right">12</td><td>GitHub Maven advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Amaven">github.com/advisories?query=ecosystem%3Amaven</a></td></tr><tr><td align="right">13</td><td>GitHub NuGet advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Anuget">github.com/advisories?query=ecosystem%3Anuget</a></td></tr><tr><td align="right">14</td><td>GitHub Go advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Ago">github.com/advisories?query=ecosystem%3Ago</a></td></tr><tr><td align="right">15</td><td>GitHub RubyGems advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Arubygems">github.com/advisories?query=ecosystem%3Arubygems</a></td></tr><tr><td align="right">16</td><td>GitHub Rust advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Arust">github.com/advisories?query=ecosystem%3Arust</a></td></tr><tr><td align="right">17</td><td>GitHub Composer advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Acomposer">github.com/advisories?query=ecosystem%3Acomposer</a></td></tr><tr><td align="right">18</td><td>GitHub Pub advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Apub">github.com/advisories?query=ecosystem%3Apub</a></td></tr><tr><td align="right">19</td><td>GitHub Swift advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Aswift">github.com/advisories?query=ecosystem%3Aswift</a></td></tr><tr><td align="right">20</td><td>GitHub Erlang advisories</td><td><a href="https://github.com/advisories?query=ecosystem%3Aerlang">github.com/advisories?query=ecosystem%3Aerlang</a></td></tr></tbody></table>

## 8.3 Language & package ecosystem advisory databases

### 8.3.1 Go

<table><thead><tr><th width="90.5625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Go Vulnerability Database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://vuln.go.dev/">vuln.go.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open data</td><td><strong><code>Relevance</code>:</strong> Official Go vulnerability database for Go modules.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong source for Go-specific affected symbols, modules, packages, &#x26; fixed versions.</td></tr><tr><td align="right">2</td><td><strong>Go vulnerability database docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://go.dev/doc/security/vuln/database">go.dev/doc/security/vuln/database</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Explains Go vulnerability DB data model &#x26; OSV usage.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for correct ingestion &#x26; symbol/package-level interpretation.</td></tr><tr><td align="right">3</td><td><strong>Go vuln browser</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://pkg.go.dev/vuln/">pkg.go.dev/vuln</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Human-readable curated Go vulnerability reports.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for triage &#x26; manual review.</td></tr><tr><td align="right">4</td><td><strong>Go vuln tooling</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck">pkg.go.dev/golang.org/x/vuln/cmd/govulncheck</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source Go module</td><td><strong><code>Relevance</code>:</strong> Go source/binary vulnerability checking.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Can reduce false positives by analyzing call reachability in Go code.</td></tr></tbody></table>

### 8.3.2 Rust

<table><thead><tr><th width="94.41796875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>RustSec</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://rustsec.org/">rustsec.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source ecosystem</td><td><strong><code>Relevance</code>:</strong> Rust crate advisory ecosystem.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Often includes Rust-specific unsoundness, yanked crates, &#x26; ecosystem-specific risk.</td></tr><tr><td align="right">2</td><td><strong>RustSec advisory DB repo</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/RustSec/advisory-db">github.com/RustSec/advisory-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Machine-ingestible Rust advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for local ingestion &#x26; cargo-audit compatible workflows.</td></tr><tr><td align="right">3</td><td><strong>RustSec advisories browser</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://rustsec.org/advisories/">rustsec.org/advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Human-browsable Rust advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for manual triage.</td></tr><tr><td align="right">4</td><td><strong>cargo-audit</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/RustSec/rustsec/tree/main/cargo-audit">github.com/RustSec/rustsec/tree/main/cargo-audit</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> RustSec-based vulnerability scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Reference implementation for Rust dependency scanning.</td></tr></tbody></table>

### 8.3.3 Python / PyPI

<table><thead><tr><th width="92.6328125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>PyPA advisory database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/pypa/advisory-database">github.com/pypa/advisory-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Python/PyPI advisory source.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use with OSV &#x26; GitHub advisories for better Python coverage.</td></tr><tr><td align="right">2</td><td><strong>PyPI security page</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://pypi.org/security/">pypi.org/security</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> PyPI security reporting &#x26; advisory context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for process context, not necessarily complete advisory ingestion.</td></tr><tr><td align="right">3</td><td><strong>pip-audit</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/pypa/pip-audit">github.com/pypa/pip-audit</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Python dependency vulnerability scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Reference implementation for Python dependency assessment.</td></tr><tr><td align="right">4</td><td><strong>Safety DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/pyupio/safety-db">github.com/pyupio/safety-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo; related products may be commercial</td><td><strong><code>Relevance</code>:</strong> Historical Python advisory source.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate freshness &#x26; licensing before relying on it.</td></tr></tbody></table>

### 8.3.4 JavaScript / npm

<table><thead><tr><th width="91.25" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>npm advisories via GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories?query=ecosystem%3Anpm">github.com/advisories?query=ecosystem%3Anpm</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> npm ecosystem vulnerability advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Semver ranges, lockfiles, transitive dependencies, &#x26; malicious packages require careful parsing.</td></tr><tr><td align="right">2</td><td><strong>Node.js Security Working Group</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/nodejs/security-wg">github.com/nodejs/security-wg</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Node ecosystem security coordination &#x26; historical advisory sources.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Some historical records may be superseded by GitHub Advisory DB.</td></tr><tr><td align="right">3</td><td><strong>npm audit docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.npmjs.com/cli/commands/npm-audit">docs.npmjs.com/cli/commands/npm-audit</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Documents npm audit behavior.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful to understand scanner behavior, dependency tree handling, &#x26; remediation suggestions.</td></tr><tr><td align="right">4</td><td><strong>Socket.dev security research</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://socket.dev/blog">socket.dev/blog</a><br><br><strong><code>Access / Cost</code>:</strong> Free public blog; product/API features may be commercial</td><td><strong><code>Relevance</code>:</strong> Malicious package &#x26; JS supply-chain threat intel.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Research source. Validate indicators &#x26; package claims against primary registries.</td></tr></tbody></table>

### 8.3.5 Java / Maven / JVM

<table><thead><tr><th width="90.37890625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Sonatype OSS Index</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ossindex.sonatype.org/">ossindex.sonatype.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free tier / API terms; Sonatype products may be commercial</td><td><strong><code>Relevance</code>:</strong> OSS vulnerability intelligence commonly used for Maven &#x26; other ecosystems.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Commercial/community source. Validate API terms, limits, &#x26; provenance.</td></tr><tr><td align="right">2</td><td><strong>Sonatype vulnerability database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://sonatype.com/resources/vulnerability-database">sonatype.com/resources/vulnerability-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free public search / commercial ecosystem</td><td><strong><code>Relevance</code>:</strong> Sonatype vulnerability intelligence database.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for enrichment &#x26; triage, but not canonical.</td></tr><tr><td align="right">3</td><td><strong>Maven Central</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://central.sonatype.com/">central.sonatype.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Package identity &#x26; metadata for JVM packages.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Not a vulnerability DB, but essential for coordinate resolution &#x26; metadata.</td></tr><tr><td align="right">4</td><td><strong>OSS Index API docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ossindex.sonatype.org/doc/rest">ossindex.sonatype.org/doc/rest</a><br><br><strong><code>Access / Cost</code>:</strong> Free tier / API terms</td><td><strong><code>Relevance</code>:</strong> REST API access for OSS Index.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Consider rate limits, authentication, &#x26; terms before ingestion.</td></tr></tbody></table>

### 8.3.6 PHP / Composer

<table><thead><tr><th width="91.62109375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>FriendsOfPHP security advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/FriendsOfPHP/security-advisories">github.com/FriendsOfPHP/security-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> PHP Composer package advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Historical &#x26; ecosystem-specific source. Cross-check with Packagist &#x26; GHSA.</td></tr><tr><td align="right">2</td><td><strong>Packagist security advisories API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packagist.org/apidoc#list-security-advisories">packagist.org/apidoc#list-security-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public API docs / public API</td><td><strong><code>Relevance</code>:</strong> Composer package advisory API.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Direct ecosystem source for Composer package advisories.</td></tr><tr><td align="right">3</td><td><strong>Composer audit docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://getcomposer.org/doc/03-cli.md#audit">getcomposer.org/doc/03-cli.md#audit</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Documents Composer audit behavior.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for implementation parity with Composer-native workflows.</td></tr></tbody></table>

### 8.3.7 Ruby

<table><thead><tr><th width="92.0625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>RubySec advisory DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/rubysec/ruby-advisory-db">github.com/rubysec/ruby-advisory-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> RubyGems advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Cross-check with GHSA RubyGems advisories.</td></tr><tr><td align="right">2</td><td><strong>Bundler audit</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/rubysec/bundler-audit">github.com/rubysec/bundler-audit</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Ruby dependency vulnerability scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Reference implementation for Gemfile.lock scanning.</td></tr></tbody></table>

### 8.3.8 .NET / NuGet

<table><thead><tr><th width="93.80859375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>NuGet advisories via GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories?query=ecosystem%3Anuget">github.com/advisories?query=ecosystem%3Anuget</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> NuGet ecosystem advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use with lockfile/project metadata for actual exposure.</td></tr><tr><td align="right">2</td><td><strong>NuGet audit docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages">learn.microsoft.com/en-us/nuget/concepts/auditing-packages</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Documents NuGet package auditing.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Microsoft ecosystem parity &#x26; remediation guidance.</td></tr></tbody></table>

### 8.3.9 Erlang / Elixir / Hex

<table><thead><tr><th width="93.28515625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Erlang advisories via GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories?query=ecosystem%3Aerlang">github.com/advisories?query=ecosystem%3Aerlang</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Erlang/Hex advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate ecosystem naming, package coordinates, &#x26; version semantics.</td></tr><tr><td align="right">2</td><td><strong>Hex package manager</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://hex.pm/">hex.pm</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Package registry for Erlang/Elixir packages.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Registry metadata helps resolve package identity.</td></tr></tbody></table>

### 8.3.10 Dart / Flutter / Pub

<table><thead><tr><th width="87.08203125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Pub advisories via GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories?query=ecosystem%3Apub">github.com/advisories?query=ecosystem%3Apub</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Dart/Pub advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Coverage depends on GitHub advisory ingestion.</td></tr><tr><td align="right">2</td><td><strong>Dart package repository</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://pub.dev/">pub.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Package registry for Dart/Flutter dependencies.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for package identity &#x26; version metadata.</td></tr></tbody></table>

### 8.3.11 Swift

<table><thead><tr><th width="92.66015625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Swift advisories via GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories?query=ecosystem%3Aswift">github.com/advisories?query=ecosystem%3Aswift</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Swift ecosystem advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Coverage depends on GitHub Advisory DB support.</td></tr><tr><td align="right">2</td><td><strong>Swift Package Index</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://swiftpackageindex.com/">swiftpackageindex.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Swift package metadata &#x26; ecosystem context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Not a vulnerability DB, but useful for package discovery &#x26; metadata.</td></tr></tbody></table>

## Discussion

This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use.

***

#### [Back to Index](/vulnkeeper/index.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://breachtrace.gitbook.io/vulnkeeper/chapter-d/08-8-open-source-vulnerability-databases-and-package-advisory-sources.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.