Security/Vulnerability

• Security vulnerability

  • Overview

    • A security vulnerability is a weakness in software, configuration, or process that violates an intended security policy—often enabling confidentiality, integrity, or availability impact when exploited.
    • In shipped products, the same word shows up across different surfaces: vulnerable dependencies, vulnerable first-party code, and vulnerable runtime configurations—each has different discovery tooling (see Security/DevSecOps/Taxonomy).

  • Where findings come from (tooling map)

    • Imported components — Software/Composition/Analysis and dependency vulnerability scanning match versions to advisories (GHSA, NVD, OSV ecosystems).
    • Your source — Security/Application/SAST flags bug classes in code under review.
    • Running behavior — Security/Application/DAST (and adjacent IAST / observability) finds issues that appear only when the system executes with real routing, auth state, and infrastructure.

  • Misconceptions

    • “One scanner type covers the SDLC” — False; composition, static, and dynamic views are complementary, not interchangeable.
    • “No CVEs in the report means no vulns” — False; coverage gaps, unreachable but reported noise, and zero-day windows all apply.