CVE Lens queries public advisory APIs and reads supported dependency files from public repositories or user-selected local files. It does not prove exploitability or guarantee safety. Only the latest version is maintained.

The server is intended for one local user on loopback. It has no multi-user authentication. A public deployment would require additional access controls and resource limits.

Use Security → Report a vulnerability on the GitHub repository when private reporting is enabled. Include reproduction steps, affected files, impact, and a minimal proof of concept with secrets removed.

If private reporting is unavailable, open an issue asking the maintainer to enable it or provide a private contact. Do not include vulnerability details or credentials in that public issue.

Keep tokens in a local .env file or environment variable. .env is excluded from Git. Use only the permissions needed for public read access. Revoke any token accidentally published in source, logs, screenshots, or Git history.

Search terms, package versions, and vulnerability identifiers are sent to the relevant providers as described in the README. Results and cache entries remain in memory.

Local uploads accept supported dependency filenames and relative paths only, with file count and byte limits. Paths are evidence labels, never filesystem read or write targets. The browser sends selected dependency contents to the loopback server; OSV receives only package identities and versions. Uploaded contents are not persisted, and project scripts are never executed.