Software security depends on accurate vulnerability data. While organizations like NIST maintain the National Vulnerability Database (NVD), the sheer volume of vulnerabilities discovered daily means that sometimes data needs improvement. At Anchore, we're working to enhance this ecosystem through open-source contributions, and we need your help.
Why Vulnerability Data Matters
When you run a security scanner like Grype, it relies on vulnerability data to determine if your software components have known security issues. This data includes crucial details like:
- Which versions of software are affected
- How the vulnerability can be exploited
- What versions contain the fix
However, this data isn't always perfect. Sometimes, version ranges are incorrect, package names don't match reality, or the metadata needs enrichment. These inaccuracies can lead to false positives (flagging secure components as vulnerable) and false negatives (missing actual vulnerabilities).
Our Approach to Better Data
We maintain a set of open-source repositories that help improve vulnerability data quality:
- A data enrichment repository where contributors can submit corrections
- Tools for processing and validating these corrections
- Generated outputs that integrate with existing vulnerability databases
This approach allows us to fix inaccuracies quickly and share these improvements with the broader security community. For example, we've helped correct version ranges for Java packages where the official data was incomplete and added missing metadata for WordPress plugins.
How You Can Help
We've published a comprehensive technical guide for contributors, but here's the quick version:
- Find an Issue: Maybe you've noticed incorrect version information in a CVE, or you're aware of missing package metadata
- Make the Fix: Clone our repository and use our tools to create or update the relevant records
- Submit a Pull Request: Share your improvements with the community
The most valuable contributions often come from security researchers and developers encountering data issues daily. Your real-world experience helps identify where the data needs improvement.
Impact of Contributions
Every contribution helps make security tooling more accurate for everyone. When you fix a false positive, you help thousands of developers avoid unnecessary security alerts. When you add missing metadata, you help security tools better understand the software ecosystem.
These improvements benefit individual developers using our open-source tools like Grype and major organizations, including Microsoft, Cisco, and various government agencies. By contributing, you'll help make the entire software supply chain more secure.
Getting Started
Ready to contribute? Here's what to do next:
- Check out our technical guide for detailed setup instructions
- Join our community forum to connect with other contributors
- Start with small improvements - even fixing one incorrect version range makes a difference
The security community strengthens when we work together. Your contributions, whether big or small, help make vulnerability data more accurate for everyone. Let's improve software security one pull request at a time.
