Upstream vulnerability disclosure (last 90d)
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor monitors whether the upstream protocol that this fork descends from has published a public vulnerability disclosure in the trailing 90 days that affects code the fork shares with the upstream. The assessment runs on an episodic, event-driven cadence: when a new upstream security advisory is published, the factor is re-evaluated for all downstream forks in the coverage list. The data source is GitHub security advisories, the upstream protocol's official disclosure channels, and security advisory feeds.
Why it matters
A fresh upstream vulnerability disclosure is an active risk elevation for all downstream forks. The 90-day trailing window captures the highest-risk period: within days of a public disclosure, sophisticated attackers scan GitHub for all forks of the affected code. The cross-hack dataset shows that fork-propagation attacks happen within 8 hours to 7 days of the original exploit in the most aggressive cases. For a depositor-facing dashboard, a live flag that 'an upstream vulnerability affecting this fork was disclosed N days ago' is one of the most actionable risk signals available -- it is a leading indicator of exploit risk with a known short time window.
Green / Yellow / Red
Green: no upstream vulnerability disclosures in the trailing 90 days affect code shared with this fork. Yellow: an upstream disclosure exists for a medium-severity issue that affects shared code; the fork team has acknowledged the disclosure and provided a patch ETA. Red: an upstream high or critical vulnerability disclosure in the trailing 90 days affects code shared with this fork and no patch has been deployed.
Common gray cases
This factor is gray for original protocols with no upstream, or when the upstream does not maintain a public security advisory channel and no disclosures are assessable.
Notable historical examples
No hacks are currently linked in the database for this specific factor in isolation. The factor's value is as a leading indicator that is most powerful in the days immediately following an upstream disclosure.
Measurement what to look for#
Determine whether the upstream has a public vulnerability disclosure in the last 90 days that affects this fork's deployed code.