Numbers on asset dashboard dont add up - are we using CVEPurl values for both (deduplicated vulnerabilities by cve, purl combination)

Repository metrics

Stars

144 stars (144 stars)

PR merge metrics

Avg merge 4d 20h (Avg merge 4d 20h)49 merged PRs in 30d (49 merged PRs in 30d)

Description

Contributor guide

Research direction

Investigate the asset dashboard count logic. Look at how vulnerabilities are counted—likely using a combination of CVE and PURL. Check if the aggregation query or deduplication logic is causing the mismatch.

Tech stack

go

Domain

backenddatabase

Issue type

Bug

DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.

3

Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.

1-3 hours

Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.

Fresh

ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.

Needs investigation

Prerequisites

GoSQL

Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.

40