{
  "id": 19729002,
  "title": "Fixing one bug in my security tool would have hidden every alert in my test project",
  "url": "https://urgent.news/2026/11/12/fixing-one-bug-in-my-security-tool-would-have-hidden-every-alert-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T23:53:40.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/samuelrojasdev/fixing-one-bug-in-my-security-tool-would-have-hidden-every-alert-in-my-test-project-l5c"
  },
  "original_language": "en",
  "account": "Samuel Rojas, the creator of depquiet, discovered that a simple bug fix nearly led to the complete suppression of all security alerts in his test project. The tool uses EPSS scores from FIRST.org to estimate a CVE's likelihood of exploitation. Rojas initially set thresholds at under 10% for filtering and under 30% for review. However, the filter didn't work correctly with Python projects, as it couldn't process CVE aliases. This oversight would have caused all 22 vulnerabilities in his test project to be filtered out, despite the EPSS scores ranging from 0.2% to 4%. Rojas realized that EPSS only provides a global statistic about the likelihood of a CVE being exploited on the internet, not about the specific vulnerabilities in his own project. To address this, he changed the default behavior in version 0.42: EPSS no longer filters anything by default, but instead sorts the findings, with known exploited CVEs appearing first, followed by the highest EPSS scores and then by severity. Users can still enable the filter using the --epss-threshold 0.05 option. Rojas also ensured that the lookup now uses the CVE alias, assigning scores to Python and npm findings. Additionally, he fixed other issues such as the old threshold being written into new config files and a crash occurring when passing a non-existent KEV file. Rojas advises developers to run their filters on real data and closely examine what is being hidden, rather than just what is kept.",
  "summary": "I maintain depquiet . It sits on top of pip-audit, uv audit and npm audit and tries to cut down the noise. The one rule I care about is that it should never hide something real. This week I found out how close I came to breaking it with what looked like a simple bug fix. The setup depquiet had an EPSS filter. EPSS is a score from FIRST.org that estimates how likely a CVE is to get exploited in…",
  "key_points": [
    "Bug fix nearly suppressed all security alerts in test project",
    "EPSS scores estimated CVE exploitation likelihood",
    "Rojas adjusted default behavior to sort findings instead"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}