AdvisoryGuard — Catch accidental data loss when editing security advisories

说明与用途

AdvisoryGuard是一个开源的TypeScript CLI工具，用于验证OSV JSON并比较安全公告记录在编辑前后的差异。它会标记被移除的CVSS条目、变更的影响版本范围、缺失的引用以及其他需要审查的元数据变更。该工具离线运行，不会修改文件，也不需要API密钥。

问题

When correcting a GitHub security advisory, a package name fix can accidentally erase CVSS severity metadata, affected-version ranges, references, and other metadata that should be preserved.

结果

AdvisoryGuard catches accidental data loss during security advisory edits by comparing OSV JSON records before and after an edit, flagging removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes for review.

工作流

• Run npx advisoryguard diff before.json after.json to compare two OSV JSON advisory records.
• Review flagged changes including removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes.
• Confirm or revert the edit based on the review.

证据

I ran into an issue while correcting a GitHub security advisory: the package name was fixed, but the edited record lost its CVSS severity metadata.

来源

So I built AdvisoryGuard, a small open-source TypeScript CLI that validates OSV JSON and compares advisory records before and after an edit.

来源

It flags removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes worth reviewing.

来源

It works offline, never modifies your files, and requires no API keys.

来源

npx advisoryguard diff before.json after.json

来源