[ahmed-sherif-hassona]

What changed and why

-This PR updates the README to clarify what dependency metadata is sent during online scans.

-Clarifies that source code and lockfiles are not uploaded.

-Explains that online scans send package names and versions to the public OSV and npm advisory APIs.

-Clarifies that a custom --osv-url only changes the OSV endpoint, not the npm advisory API.

-Explains that --offline uses the local advisory database to avoid online advisory lookups.

Closes #1480

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 9c52b16
• Latest commit, not reviewed: 42a0a5d

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Documentation
  • Clarified that package names and versions are checked online by default, while --offline enables fully offline scanning.
  • Explained that source code and lockfiles are not uploaded. Online checks send package names and versions to advisory services, package names to the configured registry for fix validation, and CVE IDs to FIRST for EPSS enrichment.
  • Noted that an internal OSV endpoint redirects OSV requests only, not npm advisory requests.

The README now states that source code and lockfiles stay local. It lists data sent during online scans, explains which requests an internal OSV endpoint changes, and describes the --offline option.

Changes: Online scan privacy documentation

Layer / File(s)	Summary
Clarify data sent during scans README.md	The README identifies data sent to OSV, npm advisory services, the configured package registry, and FIRST. It clarifies that an internal OSV endpoint redirects only OSV requests and that --offline uses a local advisory database.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other · Severity of issue fixed: Low

Possibly related issues

• OWASP/cve-lite-cli#1496: This issue identifies the website homepage as another location with the privacy claim that this README change corrects.

Possibly related PRs

• OWASP/cve-lite-cli#1450: This PR changes which package name advisory lookups and fix validation use for npm aliases. The README documents the package names sent to those services.
• OWASP/cve-lite-cli#1498: This PR updates the website version of the privacy claim corrected in this README.

Merge Risk: Minimal · previous review 9c52b

The README more accurately explains which dependency metadata online scans share and how offline scanning avoids those requests. No merge-blocking issue was identified.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title "docs: clarify dependency metadata sent during online scans" follows the required "type: short description" form. It uses the allowed type "docs", lowercase after the colon, and no trailing …
Description check		The description follows the repository template. It has the "What changed and why" section with a clear summary of the README changes. It includes a "Closes #1480" line, which fills the "Closes #" fie…
Linked Issues check		For [#1480], the README change corrects the privacy statement. It states that source code and lockfiles are not uploaded. It states that online scans send package names and versions to OSV and npm adv…
Out of Scope Changes check		The reviewed change is limited to README.md. The added disclosures about registry fix validation and EPSS enrichment describe other online data requests and support the privacy clarification in [#1480…
Linked Issue		The pull request body includes “Closes #1480”, which references a GitHub issue with an allowed keyword and issue number.
Closes Keyword Matches Scope		The body uses Closes #1480, and the README changes deliver the issue scope. The new text states that source code and lockfiles are not uploaded, identifies package names and versions sent during onl…
No New Runtime Dependency		The pull request changes only README.md. The package.json diff is empty, and its dependencies, optionalDependencies, and devDependencies sections are identical at the base and head refs. No new runtim…

Full details: Title check

Explanation

The title "docs: clarify dependency metadata sent during online scans" follows the required "type: short description" form. It uses the allowed type "docs", lowercase after the colon, and no trailing period. It matches the main change, which is a README clarification about dependency metadata sent during online scans.

Full details: Description check

Explanation

The description follows the repository template. It has the "What changed and why" section with a clear summary of the README changes. It includes a "Closes #1480" line, which fills the "Closes #" field. The bullets explain the source code and lockfile disclosure, the OSV and npm advisory requests, the --osv-url scope, and the --offline behavior. The description does not mention the FIRST EPSS enrichment or the registry fix-validation disclosure that the raw summary lists, so it is slightly incomplete, but it is mostly complete.

Full details: Linked Issues check

Explanation

For [#1480], the README change corrects the privacy statement. It states that source code and lockfiles are not uploaded. It states that online scans send package names and versions to OSV and npm advisory services. It documents --offline and the limit of --osv-url. This documentation-only issue has no applicable automated test requirement.

Full details: Out of Scope Changes check

Explanation

The reviewed change is limited to README.md. The added disclosures about registry fix validation and EPSS enrichment describe other online data requests and support the privacy clarification in [#1480]. No unrelated source, test, or configuration changes are present.

Full details: Closes Keyword Matches Scope

Explanation

The body uses Closes #1480, and the README changes deliver the issue scope. The new text states that source code and lockfiles are not uploaded, identifies package names and versions sent during online scans, documents OSV and npm advisory destinations, explains the --osv-url limitation, and provides --offline with a local advisory database. It also documents additional registry and FIRST lookups, so no issue requirement is missing.

Full details: No New Runtime Dependency

Explanation

The pull request changes only README.md. The package.json diff is empty, and its dependencies, optionalDependencies, and devDependencies sections are identical at the base and head refs. No new runtime dependency was added or moved.

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Automatic approval policy

Commit: 9c52b16daa4c.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

No overrides matched. The global limits apply.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: OWASP/cve-lite-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: 3cb5842
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: cf7bf0c8-8e0e-4c36-8df3-a7c7d591b5bc

Commits

Reviewing files that changed from the base of the PR and between fb26752 and 9c52b16.

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[sonukapoor]

Thanks @ahmed-sherif-hassona, and welcome. This is really close, and I like that you caught that --osv-url doesn't cover the npm advisory call, which the issue itself got wrong.

One sentence missing, and it's the point of the issue: the paragraph reads as though OSV and npm are the only places data goes. Fix validation also looks up package names (not versions) on your configured registry, public npm by default, and EPSS enrichment sends the CVE ids of findings to FIRST's API. Could you add a sentence for those two? --offline turns all of them off, so your last sentence stays true.

Two small ones while you're there: could --offline go in backticks to match the rest of the README, and maybe "package names and versions are checked online, or fully offline with --offline" for the line in the top table? It says what actually happens.

[ahmed-sherif-hassona]

Thanks @sonukapoor for taking the time to review my contribution!

I really appreciate your feedback. I went through your suggestions and made the necessary changes to address them.

I've updated the implementation, improved the relevant parts, and made sure the changes are consistent with the project's conventions.

Thanks again for your guidance and for helping me improve my contribution!

[sonukapoor]

Thanks @ahmed-sherif-hassona, that covers it: the fix-validation lookup and EPSS are both named now, and the top line says what actually happens. One tiny thing: the table at the top is raw HTML, where GitHub doesn't render markdown, so the backticks around --offline there would show up literally. Could that one use <code>--offline</code> instead? The paragraph further down is fine as it is.

[ahmed-sherif-hassona]

Thanks @sonukapoor for catching that! I've replaced the Markdown backticks with <code>--offline</code> in the HTML table. The paragraph further down remains unchanged. I've pushed the update.

[sonukapoor]

Thanks @ahmed-sherif-hassona, the table cell renders properly now. Approved. I merge these one at a time rather than in a batch, so it will land shortly.

[sonukapoor]

Merged - thank you @ahmed-sherif-hassona!