Upstream vulnerability disclosure (last 90d)
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor monitors whether the upstream protocol that this fork descends from has published a public vulnerability disclosure in the trailing 90 days that affects code the fork shares with the upstream. The assessment runs on an episodic, event-driven cadence: when a new upstream security advisory is published, the factor is re-evaluated for all downstream forks in the coverage list. The data source is GitHub security advisories, the upstream protocol's official disclosure channels, and security advisory feeds.
**Why it matters** A fresh upstream vulnerability disclosure is an active risk elevation for all downstream forks. The 90-day trailing window captures the highest-risk period: within days of a public disclosure, sophisticated attackers scan GitHub for all forks of the affected code. The cross-hack dataset shows that fork-propagation attacks happen within 8 hours to 7 days of the original exploit in the most aggressive cases. For a depositor-facing dashboard, a live flag that 'an upstream vulnerability affecting this fork was disclosed N days ago' is one of the most actionable risk signals available -- it is a leading indicator of exploit risk with a known short time window.
**Green / Yellow / Red** Green: no upstream vulnerability disclosures in the trailing 90 days affect code shared with this fork. Yellow: an upstream disclosure exists for a medium-severity issue that affects shared code; the fork team has acknowledged the disclosure and provided a patch ETA. Red: an upstream high or critical vulnerability disclosure in the trailing 90 days affects code shared with this fork and no patch has been deployed.
**Common gray cases** This factor is gray for original protocols with no upstream, or when the upstream does not maintain a public security advisory channel and no disclosures are assessable.
**Notable historical examples** The factor's value is as a leading indicator that is most powerful in the days immediately following an upstream disclosure.
Measurement what to look for #
Determine whether the upstream has a public vulnerability disclosure in the last 90 days that affects this fork's deployed code.