# Security advisories

Some search results and pulls carry a `security_advisories` field. It lists published CVE and GHSA identifiers that name the component's **repository**.

```json
"security_advisories": {
  "ids": ["CVE-2025-XXXXX", "GHSA-xxxx-xxxx-xxxx"],
  "scope": "repository",
  "note": "Published advisories naming this repository; check whether they affect this file and version. Not used in ranking."
}
```

## What it means

- An advisory exists that names the repository. It may affect a different file, an older version, or a feature you don't use.
- Check the advisory against the file and version you are pulling before you ship it. Searching the identifier on the GitHub Advisory Database or NVD shows the affected versions.

## What it does not mean

- **It is not part of the score or the ranking.** A repository with advisories is not demoted; we show the warning instead, so you can decide.
- **No warning is not a clean bill of health.** The field is filled only for repositories we have reputation data for, which today is a small set of widely used projects. Most results have no `security_advisories` field because we have no data for them, not because they are known to be safe.
- It is not a vulnerability scan of the file itself.

For dependency-level checks after you pull code, keep using your usual tools (`npm audit`, `pip-audit`, Dependabot or similar).