vulnerability-management

---
name: vulnerability-management
description: Dependency scanning, CVE tracking, patch management, and security posture measurement.
license: Apache-2.0
---

# Vulnerability Management

> Dependency scanning, CVE tracking, patch management, and security posture measurement.

## Core Concepts

### Dependency Scanning
Continuous vulnerability detection.

```bash
# npm audit
npm audit --json

# Snyk CLI
snyk test --json

# OWASP Dependency-Check
dependency-check --project "MyApp" --scan /path/to/app
```

### CVE Tracking
Monitor and prioritize vulnerabilities.

```typescript
interface Vulnerability {
  cve: string;
  severity: 'critical' | 'high' | 'medium' | 'low';
  package: string;
  affectedVersions: string[];
  patchAvailable: boolean;
  exploitKits: number;
  discoveryDate: Date;
}

class VulnerabilityTracker {
  async trackNewCVE(vuln: Vulnerability): Promise<void> {
    const severity_score = this.calculateSeverity(vuln);
    const priority = this.prioritizePatching(severity_score);

    await this.db.vulnerabilities.insert({
      ...vuln,
      priority,
      status: 'discovered',
      discoveredAt: new Date()
    });
  }
}
```

### Patch Management
Automated patching workflow.

```yaml
# Dependabot configuration
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    allow:
      - dependency-type: "direct"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
```

### Security Posture Dashboard
Measure and track improvements.

```typescript
interface SecurityMetrics {
  totalDependencies: number;
  vulnerableVersions: number;
  unpatched: number;
  averagePatchTime: number;  // days
  complianceScore: number;   // 0-100
}

class SecurityDashboard {
  getMetrics(): SecurityMetrics {
    return {
      totalDependencies: 145,
      vulnerableVersions: 8,
      unpatched: 2,
      averagePatchTime: 7,
      complianceScore: 92
    };
  }
}
```

## Best Practices

1. **Automated Scanning**: CI/CD integration
2. **Regular Updates**: Weekly dependency checks
3. **Prioritization**: Patch by severity
4. **Communication**: Alert on new vulnerabilities
5. **Compliance**: Track metrics for audits

## Related Skills

- Container Security
- CI/CD Pipelines
- Monitoring & Observability

---

**Token Savings**: ~850 tokens | **Last Updated**: 2025-11-08 | **Installs**: 912 | **Remixes**: 298