CVE Research: The First Pass

First pass: broad and raw

Once the scope is framed (previous module), the agent launches its search. Concretely, that can mean cross-referencing the project's lockfile against a public advisory database, or relying on an existing audit tool.

Here's what a raw output might look like for a hybrid .NET/Node project:

high      next                pnpm-lock.yaml   28 alerts
high      pnpm                pnpm-lock.yaml   18 alerts
high      undici              pnpm-lock.yaml   16 alerts
medium    postcss             pnpm-lock.yaml    4 alerts
critical  handlebars          pnpm-lock.yaml    1 alert

A first pass, not a verdict

This list is deliberately broad: it contains everything that matches, without distinguishing what's genuinely critical from what's noise. A package can show up with 28 alerts simply because it's far behind its latest stable release — without that meaning the project is actually exposed.

That's normal, and even desirable at this stage: an agent that surfaces too much is better than one that filters too early and misses a real problem. Sorting comes after.