Respond to Vulnerabilities (RV)

RV.1.1: Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, and investigate all credible reports.

RV.1.2: Review, analyze, and/or test the software’s code to identify or confirm the presence of previously undetected vulnerabilities.

RV.1.3: Have a policy that addresses vulnerability disclosure and remediation, and implement the roles, responsibilities, and processes needed to support that policy.

Continuously scans manifests/locks against OSV; great for confirming new disclosures across all supported releases..

Continuously synchronizes Software Bill of Material versions of built artifacts to OSV.dev reporting on vulnerabilities discovered post-build.

Queries the OSV.dev vulnerability database for open-source package CVEs.

Scans container images and SBOMs for known vulnerabilities.

Aggregates multiple public vulnerability feeds.

Checks installed binaries for known CVEs.

SAST for multiple languages; customizable rules. Run on merge to main branch.

Python security linting. Add to Python project build stage.

SAST & quality checks. Run in build step; block deploy if high-severity issues found.

DAST; quick passive scan on deployed staging app.

Public policy location for reporters.

Vulnerability Disclosure Program.

Playbook for implementing disclosure.

RV.2.1: Analyze each vulnerability to gather sufficient information about risk to plan its remediation or other risk response.

RV.2.2: Plan and implement risk responses for vulnerabilities.

Aggregates SBOMs, attestations, and vulns to understand blast radius and prioritize fixes.

Automates dependency upgrades/patch PRs with risk-aware policies.

Exposes the blast radius of each vulnerability across live environments.

Centralizes vulnerabilities from SAST/DAST/SCA tools; adds risk scoring.

SBOM-based vuln tracking, includes CVSS scoring and metadata.

Rates probability of exploitation for CVEs (risk-based prioritization).

Provides exploit links, PoCs, and additional context per CVE.

Standardized impact scoring to support triage decisions.

Sign remediated builds before deploying (trusted delivery mechanism).

Temporary WAF rules to mitigate unpatched web vulns.

Runtime detection and mitigation for unpatched container/Kubernetes issues.

RV.3.1: Analyze identified vulnerabilities to determine their root causes.

RV.3.2: Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently

RV.3.3: Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external reports.

RV.3.4: Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or in new software that is created.

Write org-specific rules to detect the root-cause pattern; scan repos to eradicate classes of bugs.

Deep code queries to identify the precise coding constructs leading to vulns.

Provides issue traces, rule violations, and hotspots including root cause indicators.

Tracks vulns + metadata, allows attaching root cause notes per issue.

Long-term tracking of vulnerable components to see recurring dependency issues.

Metadata API for tracking security events across builds/releases.

Detects weakness patterns (CWEs) in binaries, useful for compiled artifacts.

Open-source code analysis platform for hunting bug patterns at scale.

Framework to improve secure dev lifecycle practices.

Automates repo security health checks (branch protection, dependency pinning, CI hardening).

Standard for documenting compliance + SDLC security improvements.

Enforces security policies across GitHub orgs/repos.