AdvisoryGuard — Catch accidental data loss when editing security advisories

Описание и применение

AdvisoryGuard — TypeScript CLI для проверки и сравнения записей о ​​безопасных ​​сообщениях OSV перед и ​​после ​​правки. Она ​​подсвечивает ​​удаленные ​​CVSS-записи, ​​измененные ​​affected-версии ​​диапазоны, ​​отсутствующие ​​ссылки ​​и ​​другие ​​метаданные ​​для ​​просмотра. Работает ​​offline, ​​не ​​изменяет ​​файлы ​​и ​​не ​​требует ​​API-ключей.

Задача

When correcting a GitHub security advisory, a package name fix can accidentally erase CVSS severity metadata, affected-version ranges, references, and other metadata that should be preserved.

Результат

AdvisoryGuard catches accidental data loss during security advisory edits by comparing OSV JSON records before and after an edit, flagging removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes for review.

Рабочий процесс

• Run npx advisoryguard diff before.json after.json to compare two OSV JSON advisory records.
• Review flagged changes including removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes.
• Confirm or revert the edit based on the review.

Доказательства

I ran into an issue while correcting a GitHub security advisory: the package name was fixed, but the edited record lost its CVSS severity metadata.

Источник

So I built AdvisoryGuard, a small open-source TypeScript CLI that validates OSV JSON and compares advisory records before and after an edit.

Источник

It flags removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes worth reviewing.

Источник

It works offline, never modifies your files, and requires no API keys.

Источник

npx advisoryguard diff before.json after.json

Источник