News for hackers. Stuff that matters.

A comment on GitHub Advisory Database now powers NPM audit. Parent comment

Re:GitHub Advisory Database now powers NPM audit by Hallucinaut on Thursday October 07, 2021 @02:42PM (#28790487)
The problem is it gets weaponized. If you're unlucky you have a client who runs a scan naively on your software and demands these get addressed as critical priorities under SLA.

I'm sure there are plenty out there with managers who will just run the report and demand these "security issues" are fixed and won't understand an explanation on why it's not relevant.

[ Parent | on HN ]
Re:GitHub Advisory Database now powers NPM audit by bawolff on Thursday October 07, 2021 @03:35PM (#28791078)
This is a silly objection in my opinion - clients demand unreasonable things all the time. Its up to you to write a reasonable SLA that protects yourself.

Dont get me wrong, i wish npm audit was better. But unreasonable people will be unreasonable regardless of the tools they have access to.

[ Parent | on HN ]