Unpacking Discrepancies: Why Your Vulnerability Scanners Might Disagree

The Scanner Discrepancy Dilemma

In the complex world of software development, maintaining a robust security posture is paramount. Developers often rely on multiple tools for vulnerability scanning, but what happens when these tools report conflicting results? This was the core question posed by a GitHub community member, CaptainsCut, who reported a significant disparity: Hostinger identified 27 vulnerabilities in their project, while GitHub's Dependabot showed no open alerts.

The Core Problem: Hidden Vulnerabilities or Misaligned Scanners?

CaptainsCut's Hostinger scan detailed numerous high-severity vulnerabilities across critical packages like js-yaml (versions 3.15.0, 4.3.0), svgo (versions 1.3.2, 2.8.1), and fast-uri (version 3.1.2). These included CVEs related to CPU use, executable links, server-side request forgery, and host confusion, with clear upgrade paths suggested. The sheer volume and severity of these unpatched dependencies, contrasted with Dependabot's silence, raised a critical concern about the project's true security standing. This scenario highlights a common challenge in development analytics: ensuring all security tools provide a consistent and comprehensive view of your codebase's health.

Decoding the Discrepancy: Common Causes and Solutions

Cybertrist, a community expert, provided an insightful breakdown of why such discrepancies occur, pointing out that both Hostinger and Dependabot likely draw from the same underlying advisory databases, such as the GitHub Advisory Database. The difference often lies in how these tools access and process dependency information.

Cause 1: GitHub Repository Settings

• Private Repositories: For private repositories, GitHub's dependency graph and Dependabot alerts are not enabled by default. This means Dependabot simply won't scan or report on vulnerabilities unless explicitly configured.
• Solution: Navigate to your repository's Settings, open the Security section in the sidebar, and ensure both "Dependency graph" and "Dependabot alerts" are turned on. Allow some time for the initial scan to complete.

Cause 2: Missing Lockfiles and Transitive Dependencies

• Dependabot's Scope: Dependabot primarily focuses on direct dependencies listed in your package.json (or equivalent for other ecosystems) and relies heavily on committed lockfiles (e.g., package-lock.json, yarn.lock) to accurately identify transitive dependencies.
• Scanner Differences: Tools like Hostinger often scan the entire installed dependency tree, catching vulnerabilities in transitive dependencies even without a lockfile. Many of the reported vulnerabilities (like older svgo and js-yaml versions) are typically brought in as transitive dependencies by older build tools.
• Solution: Always commit your lockfiles. This provides Dependabot with the complete dependency tree, enabling it to detect vulnerabilities in transitive dependencies.

Practical Steps for Resolution

Once the underlying causes are addressed, resolving the vulnerabilities becomes more straightforward:

• Local Verification: Run npm audit locally to confirm the presence of the reported vulnerabilities. This command should list the same packages and issues found by Hostinger.
• Automated Fixes: Use npm audit fix to automatically update many vulnerable packages to their patched versions.
• Manual Overrides: For stubborn transitive dependencies that can't be updated automatically due to parent package constraints, use an overrides block in your package.json to force the use of a patched version.

"overrides": {
  "fast-uri": "^3.1.6"
}

After applying overrides, reinstall dependencies and commit the updated lockfile.

Enhancing Your Security Development Analytics

This discussion underscores the critical need for a comprehensive approach to software security. Relying on a single scanner or incomplete configurations can leave significant blind spots. By understanding the nuances of different security tools and ensuring proper setup, developers can gain clearer development analytics into their project's security health. Integrating these practices into your workflow, perhaps tracked via engineering project management software, ensures that vulnerability management is a proactive and consistent part of your development lifecycle, ultimately leading to more secure and reliable applications.