Ssdlc on Samarthya

Learning OSV, part 5: I scanned my own blog, and the real problem wasn't in the report

Wed, 04 Nov 2026 21:00:00 -0500

A test project is a controlled experiment; your own repository is the one that talks back. I pointed OSV-Scanner at the source of this blog expecting a dull report. The report was indeed dull. The interesting part was what it could not see.

The mood of the evening. It lasted until the first command.

In parts 2 and 3 I used a project built to be vulnerable. This time the target is the repository behind this site: Hugo, the Blowfish theme as a git submodule, some Python helper scripts and two GitHub Actions workflows. All runs used OSV-Scanner v2.7.0.

Learning OSV, part 4: where it fits, and my recommendation

Sat, 31 Oct 2026 07:45:00 -0400

Three parts of trying things. This one is the verdict: what I would actually switch on, in what order, and what I would still look elsewhere for.

The loop I would run, and the verdict as a checklist.

Quick recap of the proof of concept: part 1 read the database, part 2 scanned a project (5 dependencies, 68 packages, 49 vulnerabilities), and part 3 fixed it (7 of 50 safely, 50 of 50 with a major upgrade).

Learning OSV, part 3: guided remediation with osv-scanner fix

Sat, 31 Oct 2026 07:30:00 -0400

Finding 49 vulnerabilities is easy. Deciding which three lines to change so that most of them go away is the hard part. That is what osv-scanner fix tries to do.

in-place is the safe small win; relax fixes everything but chose a major upgrade.

In part 2 the scanner found 49 known vulnerabilities in a small Node project. This part tries the guided remediation command on it.

Learning OSV, part 2: scanning a project with OSV-Scanner

Sat, 31 Oct 2026 07:15:00 -0400

I picked four dependencies. The scanner found problems in eleven packages. That gap is the whole reason to scan lockfiles and not just package.json.

Five dependencies I chose became 68 packages; 11 are affected, six of them only because Express pins them.

Part 1 was about the OSV database. This part runs the scanner against a small project and reads the result.

Learning OSV, part 1: what osv.dev is and how to read a record

Sat, 31 Oct 2026 07:00:00 -0400

A CVE tells you that something is broken. It rarely tells you, in a way a machine can use, which package and which versions. OSV exists to answer exactly that.

One record, read as data: the affected range runs from introduced 1.0.0 to fixed 1.2.6, so 1.2.5 is vulnerable and the upgrade target is 1.2.6.

I am learning which free tools can carry real weight in a secure development life cycle. This short series is my proof of concept with OSV: the database, the scanner and its fix command. I run everything for real and keep the output. This part is about the concept and the website.