Исправление одной ошибки в моем инструменте безопасности могло скрыть все предупреждения в моем тестовом проекте

Оригинал

Fixing one bug in my security tool would have hidden every alert in my test project

I maintain depquiet. It sits on top of pip-audit, uv audit and npm audit and tries to cut down the noise. The one rule I care about is that it should never hide something real. This week I found out how close I came to breaking it with what looked like a simple bug fix. The setup depquiet had an EPSS filter. EPSS is a score from FIRST.org that estimates how likely a CVE is to get exploited in the next 30 days. My defaults were: under 10%: filter it out under 30%: move it to "revie