4 ms·
These confuse me because they don't align with yarn/npm audit. Which one is right? It is pretty unrealistic to dig into it myself.
by ericmcer 6y ago
These confuse me because they don't align with yarn/npm audit. Which one is right? It is pretty unrealistic to dig into it myself.
- fulafel 6y agoGenerally these scanners can have two possible opinions about a dependency: "contains security bug" and "don't know" - they can't prove absence of vulnerabilities. So if tool A flags a dependency and tool B doesn't, both are likely right, and you should treat it as a flagged dependency.