Fixing one bug in my security tool would have hidden every alert in my test project

Samuel Rojas, the creator of depquiet, discovered that a simple bug fix nearly led to the complete suppression of all security alerts in his test project. The tool uses EPSS scores from FIRST.org to estimate a CVE's likelihood of exploitation. Rojas initially set thresholds at under 10% for filtering and under 30% for review. However, the filter didn't work correctly with Python projects, as it couldn't process CVE aliases.

This oversight would have caused all 22 vulnerabilities in his test project to be filtered out, despite the EPSS scores ranging from 0.2% to 4%. Rojas realized that EPSS only provides a global statistic about the likelihood of a CVE being exploited on the internet, not about the specific vulnerabilities in his own project. To address this, he changed the default behavior in version 0.42: EPSS no longer filters anything by default, but instead sorts the findings, with known exploited CVEs appearing first, followed by the highest EPSS scores and then by severity.

Users can still enable the filter using the --epss-threshold 0.05 option. Rojas also ensured that the lookup now uses the CVE alias, assigning scores to Python and npm findings. Additionally, he fixed other issues such as the old threshold being written into new config files and a crash occurring when passing a non-existent KEV file.

Rojas advises developers to run their filters on real data and closely examine what is being hidden, rather than just what is kept.