{"ok":true,"trend":{"id":520860,"platform":"mastodon","region":"global","key":"most dependency scanners only tell you about vulnerabilities that already have an advisory filed... # opensource # secur","title":"Most dependency scanners only tell you about vulnerabilities that already have an advisory filed... # opensource # secur","url":"https://www.urbanmind.net/display/f7dd981d-f518af9c-4d6654727cfa6c6c","first_seen":"2026-09-30T19:45:49.527354Z","last_seen":"2026-09-30T19:45:49.527354Z","last_rank":6,"peak_rank":6,"last_volume":3,"peak_volume":3,"seen_count":1,"score":0.98859375,"category_hint":"software","section":"technology","category":"software","summary":"Security commentators are highlighting a blind spot in common dependency scanners: they only catch vulnerabilities once a formal advisory has been filed. OpenSSF Scorecard is being promoted as a complementary tool, assessing open-source packages for risky practices and structural weaknesses before any advisory is published, giving developers an earlier warning signal about the software they rely on.","why":"Growing concern over software supply chain security and gaps in existing dependency scanning tools","tone":"neutral","entities":["OpenSSF","OpenSSF Scorecard","GitHub"],"summarized_at":"2026-09-30T19:47:50.545057Z","meta":{"tag":"opensource","via":"scan","kind":"status","lang":"en","instance":"mastodon.social","tag_uses":1332},"nw":null,"promo":null,"kind":null,"importance":null,"hidden":false,"hide_reason":null,"judged_at":null,"title_en":"OpenSSF Scorecard flags package risks before advisories exist","section_name":"Technology","category_name":"Software","timeline":[{"captured_at":"2026-09-30T19:45:49.527354Z","rank":6,"volume":3}],"posts":[{"platform":"mastodon","url":"https://www.urbanmind.net/display/f7dd981d-f518af9c-4d6654727cfa6c6c","author":"hackaday@www.urbanmind.net","title":null,"snippet":"Most dependency scanners only tell you about vulnerabilities that already have an advisory filed... # opensource # security # devsecops # github # software # coding # development # engineering # inclusive # community OpenSSF Scorecard explained: catching risk in packages that…","posted_at":"2026-09-30T16:52:51Z","likes":3}],"elsewhere":[],"window":"7d"}}