[Bug] docs: clarify dependency metadata sent during online scans

Open Beginner friendly
  • Is something wrong?
#1,480 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@ahmed-sherif-hassona is already working on this.

Since Nov 3, 2026.

  • #1489 by @ahmed-sherif-hassona — open

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
85/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Tech stack
nodejs, typescript
Domain
documentation

Research direction

The inaccurate sentence is the 'Nothing leaves your machine' line in README.md. Check the request payloads in src/advisory/osv-advisory-source.ts and src/advisory/npm-advisory-source.ts, which send package names and versions, by running cve-lite . --no-cache --debug. Done when the README states that source and lockfiles stay local, that package names and versions go to the advisory services in online mode, and that --offline or an internal OSV endpoint keeps metadata inside the network.

Written by the indexing model from the issue text.

Description

documentation enhancement

Summary

The README currently says:

Nothing leaves your machine: not your code, not your dependency tree.

Source code and lockfiles remain local, but online scans send package names and versions to OSV and npm's advisory API. The current wording incorrectly suggests that dependency metadata never leaves the machine.

Expected behavior

The documentation should clearly state:

CVE Lite CLI never uploads source code or lockfiles. In online mode, it sends package names and versions to the configured advisory services. Use --offline or an internal OSV endpoint when dependency metadata must remain inside your network.

Actual behavior

The README's “not your dependency tree” statement is broader than the implementation. The online advisory requests include package names, scopes, and versions.

Reproduction

Run an online scan with a project containing dependencies:

cve-lite . --no-cache --debug

The OSV batch request contains the dependency package names and versions. The npm supplemental advisory request also sends npm package names and versions to the public npm advisory endpoint.

Relevant files

  • README.md
  • src/advisory/osv-advisory-source.ts
  • src/advisory/npm-advisory-source.ts

This issue is limited to correcting the documentation so the local-first privacy behavior is described accurately.

Dominant language
TypeScript
Stars
786
Forks
189
Avg merge
3d 2h
Merged PRs (30d)
85

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/cve-lite-cli

All issues in OWASP/cve-lite-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.