# Security advisories
Some search results and pulls carry a `security_advisories` field. It lists published CVE and GHSA identifiers that name the component's **repository**.
```json
"security_advisories": {
"ids": ["CVE-2025-XXXXX", "GHSA-xxxx-xxxx-xxxx"],
"scope": "repository",
"note": "Published advisories naming this repository; check whether they affect this file and version. Not used in ranking."
}
```
Pulls (`get_component`) with advisories also carry a `security` object: the worst severity, counts by severity and the most severe advisories (up to 15) with summary, CVSS score, affected package and the versions that fix it:
```json
"security": {
"status": "advisories", "count": 12, "max_severity": "high", "scope": "repository", "source": "osv.dev",
"by_severity": {"high": 3, "moderate": 8, "low": 1},
"advisories": [{"id": "GHSA-xxxx-xxxx-xxxx", "severity": "high", "cvss": 7.5,
"summary": "Prototype pollution in ...", "packages": ["npm:example"],
"fixed_versions": ["2.19.3"], "published": "2024-05-01",
"url": "https://github.com/advisories/GHSA-xxxx-xxxx-xxxx"}],
"note": "Advisories name the source repository, not necessarily this file or version: ..."
}
```
## Check components any time
`check_component_security` (free, needs a free key) takes up to 25 component ids and up to 25 repository names (`owner/repo` or a GitHub URL) and returns `advisories` (with severity, summary and fixed versions), `none_known` (with how many published packages we checked) or `not_found` for each. Use it before you pull, and on code you pulled earlier: advisories are added as our data is refreshed. Your [account page](/account#security) lists the components you pulled whose repository now has advisories. We do not email these alerts.
## Libraries a component imports
`get_component` also reports on the third-party libraries the component imports (npm, PyPI, Go modules and Rust crates), in `dependency_security`: for each library, how many advisories OSV has published (`advisories_count`), the worst severity, the current release (`latest`) and whether that release is affected (`latest_affected`). A snippet rarely pins versions, so these are facts about the library, not a verdict on the snippet (`version_seen: "unpinned"`). `advisories_as_of` says how fresh the data is (refreshed daily).
`check_component_security` takes `packages` too: up to 50 `{"ecosystem", "name", "version"}` (ecosystem `npm`, `PyPI`, `Go` or `crates.io`) and answers per exact version: `vulnerable`, `no_known_advisories`, `unknown` (a version or range we could not compare: we never guess "safe") or `unpinned` (no version given).
Every key gets the counts and the worst severity. **Pro** also gets each advisory (id, summary, affected ranges, fixed versions), `fixed_in` and `latest_safe`, and can pass `exclude_vulnerable=true` to `search_components` to hide components whose imported libraries' latest release has a known high or critical advisory.
## How much data there is
Every week we look up the packages each public repository publishes (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, Packagist, GitHub Actions) on [deps.dev](https://deps.dev) and fetch their advisories from [OSV](https://osv.dev), which aggregates the GitHub Advisory Database, PyPA, Go, RustSec and others. A package only counts when its name or scope says it is that repository, so look-alike packages that merely link to it are ignored.
Advisory data currently covers 8,372 repositories (4,267 publish packages we could check); 520 have at least one published advisory (4,116 advisories in total). Repositories that publish no package (most apps and examples) can only show `none_known`, so treat the field as a useful warning, not a scan.
## What it means
- An advisory exists that names the repository. It may affect a different file, an older version, or a feature you don't use.
- Check the advisory against the file and version you are pulling before you ship it. `fixed_versions` tells you which release fixes it; the link has the full affected ranges.
## What it does not mean
- **It is not part of the score or the ranking.** A repository with advisories is not demoted; we show the warning instead, so you can decide.
- **No warning is not a clean bill of health.** Advisories are known only for repositories that publish packages to a registry OSV covers. Most results have no advisory because there is nothing published to check, not because they are known to be safe.
- It is not a vulnerability scan of the file itself.
For dependency-level checks after you pull code, keep using your usual tools (`npm audit`, `pip-audit`, Dependabot or similar).