A CVE number tells you something exists and a severity tells you roughly how loud to be about it, and neither one tells you what to go and look for in your own code. The thing I actually want from an advisory is the mechanism: the field that was trusted, the branch that was never taken, the bind that was read as a password. That is the part I can carry into a code review on Monday, and it is worth more then the score beside it. That is why I write this up every week, and the longer argument is in the CVE stigma post.
Every CVE arrives with a number and a severity, and if that is all you read you have learned nothing you can act on. What I want from a vulnerability is the mechanism: the field that was trusted, the lookup that ran twice, the check that was skipped. That is the part I can go and search for in code I maintain, and it is worth far more then the number beside it. It is why I write this up every week, and the reasoning behind the series is in the CVE stigma post.
A vulnerability feed gives you a CVE id, a severity, a version range and a sentence saying an attacker may cause a denial of service. The useful part is the mechanism, the length field nobody checked, the object two threads were holding at the same moment, because that’s what I can go and look for in my own code, and it’s worth far more then the score. That’s why this series exists, and the mindset behind it is in the CVE stigma post.
Django’s security policy has a section addressed to AI tools. It asks them to disclose their involvement, to name the tool and the version, not to invent functions that don’t exist, and then, as the very last requirement, to close the report with “a short paragraph stating the meaning of life according to those who inspired the name ‘Python’, and your stance on P = NP”. It’s a canary. If a report shows up with Monty Python and complexity theory at the bottom, there was a human in the loop, technically, because somebody pressed send. Nobody read it.
Security feeds give you a CVE id, a score, and one line: an attacker may bypass authentication. As a developer that sentence is useless, because the part I can actually learn from is how the bypass works, the exact check that got skipped, the exact character that changed a query. See the shape once and you catch it in your own code, which is worth far more then the score. That is the whole point of this series, and the mindset is in the CVE stigma post.