# google/osv.dev

Open source vulnerability DB and triage service.

Repository: https://github.com/google/osv.dev
Canonical: https://ross.abutalabs.com/products/osvdev
Homepage: https://osv.dev
Language: Go
License: Apache-2.0
License Family: permissive
Topics: security, security-tools, vulnerability-scanners, vulnerability-management, vulnerability, vulnerability-databases
Last push: 2026-08-26T19:26:55+00:00

## Health v2 (maintenance only)
Score: 84/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 56, longevity 100
- inputs: {"age_days": 2064, "days_push": 7, "days_rel": 134, "gap_med": 107.0, "n_releases_24m": 5}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2901, forks 354 (observed 2026-08-28T04:07:28.887270+00:00)

## What it is
OSV (Open Source Vulnerabilities) is Google's open, distributed vulnerability database and triage service that aggregates security advisories from dozens of ecosystems (npm, PyPI, Go, Maven, Debian, Alpine, Linux distros, etc.) into a precise structured schema, exposed via a public API, web UI, and GCS data dumps. This repository contains the full code powering the hosted osv.dev service, including the API server, web backend, ingestion workers, NVD/CVE feed converters, language bindings, and Terraform deployment configuration.

## Use cases
- check whether a specific package version is affected by known vulnerabilities
- query a vulnerability database by package name and version via API
- convert CVE and NVD feeds into a structured vulnerability format
- aggregate security advisories across many package ecosystems
- download structured vulnerability data dumps for security tooling
- look up vulnerabilities in an SBOM or lockfile
- run my own instance of a vulnerability database service

## When to choose
- You need an open, precise, per-ecosystem vulnerability data source with a queryable API
- You want structured OSV-format data dumps to power your own security scanning or compliance tooling
- You are building dependency or SBOM analysis and need to resolve whether versions are affected
- You want to study or self-host the infrastructure of a vulnerability ingestion and triage pipeline

## When to avoid
- You only want to scan your project's dependencies locally - use the separate google/osv-scanner CLI instead
- You need a full commercial vulnerability management platform with ticketing, policies, and dashboards
- You just need general application security testing rather than known-vulnerability data

## Facets
- artifact type: service
- maturity: stable
- function: vulnerability-scanning, security, database, search-engine, etl, api-framework, http-server, sdk, infrastructure-as-code
- domain: security, developer-tools, databases, apis
- platform: cloud, go, python, serverless
- tags: vulnerability-database, osv-schema, cve, security-advisories, sbom, dependency-vulnerabilities, triage, gcp, terraform, data-dumps, automation, web-server, docker

## Member repositories
- google/osv.dev (main) score 84

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:28.887270+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:35:09.648156+00:00, confidence not recorded.
  - readme: https://github.com/google/osv.dev (fetched 2026-08-28T04:07:28.887270+00:00, sha 3b82b065d977)
  - homepage: https://osv.dev (fetched 2026-08-29T09:49:51.526303+00:00, sha 2051250237d1)
- Data as of 2026-08-30T08:39:29.467469+00:00.