# Security vulnerabilities

## Introduction

The security vulnerabilities feature checks for known, publicly disclosed vulnerabilities in the R package being assessed. It is accessed through:

- `get_security_vulnerabilities()` — the exported function that retrieves advisories for a package.

It also runs automatically as part of a full assessment via `risk_assess_pkg()` / `assess_pkg()`.

## Where the data comes from

Advisories are retrieved from the Open Source Vulnerabilities (OSV) database (https://osv.dev) using a `POST` request to the query endpoint `https://api.osv.dev/v1/query`. For R packages, OSV serves advisories from the R Consortium r-advisory-database, which carry `RSEC-*` identifiers.

The package is queried by name only within the `"CRAN"` ecosystem. All advisories for the package are fetched, then filtered locally against the installed version. Querying by name (rather than name + version) avoids missing range-based advisories that a version-scoped OSV query can silently omit.

## Load the package

    library(risk.assessr)

## Retrieving vulnerabilities directly

    vulns <- get_security_vulnerabilities("commonmark", "1.7")
    vulns

The function returns a data frame with one row per advisory and the following columns:

- `id` — advisory identifier (e.g. `RSEC-2023-6`)
- `summary` — short vulnerability type
- `details` — full description
- `introduced` — version the issue was introduced
- `fixed` — version the issue was fixed
- `modified`, `published` — advisory timestamps

If no advisories apply, a zero-row data frame with the same columns is returned. Omitting the version returns every advisory known for the package.

## Within a full assessment

When you assess a package, the vulnerabilities are stored in the results object:

    result <- risk_assess_pkg(package = "commonmark", version = "1.7")
    result$results$vulnerabilities

## How results are reported

Summary report — vulnerabilities appear as a single metric, “Security Vulnerabilities”, showing the count of advisories found. Any count of one or more is scored High risk; zero is scored Low. This contributes to the overall recommendation alongside the other risk metrics.

HTML report — when advisories are found, the report renders a red-headed, searchable table listing every advisory (`ID`, `Summary`, `Details`, `Introduced`, `Fixed`, `Modified`, `Published`). When none are found, a green “No security vulnerabilities” banner is shown instead.

## Limitations

- Only the `"CRAN"` ecosystem is queried; Bioconductor is not auto-detected.
- The feature requires network access to the OSV API.
- API failures return an empty result, so absence of rows is not by itself a guarantee that a package is free of vulnerabilities — check the console messages.
- Vulnerability scoring is not configurable through `risk-definition.json` at the moment.