Only the advisories that affect you

Security advisory feeds are firehoses. Subscribe to the ones covering your stack and you will get several a day, almost none of which apply to you, and within a month nobody is reading any of them.

Filtering against what you actually run is the entire job.

Filter against the lockfile, not the ecosystem

The difference between useful and useless here is whether the filter knows your dependencies, including transitive ones and the versions you are actually on.

Every weekday at 8am, check new security advisories against what we
actually depend on.

Report only advisories affecting a package we use, at a version we are
running. Check transitive dependencies, not just direct ones.

For each:
  the package and the version we are on
  what the advisory says, in one sentence
  whether we are actually exposed, given how we use it, or whether you
    cannot tell
  what version fixes it, and whether that is a breaking change

If nothing affects us, say so and stop. Most days nothing will.

"Whether we are actually exposed, or you cannot tell" is what separates this from a feed. Half of advisories describe a vulnerability in a code path nobody reaches — a parser you never call, a server mode you do not run. Saying "affected version, but this is only reachable through the CLI and we use the library" is triage. Refusing to guess when it cannot tell is what makes the triage trustworthy.

Read the breaking-change field first

In practice, that is what decides what happens today. A patch bump is done before standup. A major version bump on a core dependency is a piece of work that needs planning, and knowing which you are looking at is most of the decision.

Open work for the reachable ones only

Once you trust the exposure judgement, have it open an issue for anything genuinely reachable, and merely report the rest weekly.

Do that only after a couple of weeks of watching. An unfiltered advisory feed turned into tickets will bury a backlog faster than almost anything else.

Re-check the ones it could not tell

The uncertain pile is small and worth a human glance, because it is where a real exposure hides behind an unusual usage pattern. It is also the list that tells you which parts of your dependency use are poorly understood.

What good looks like

Most days, nothing. Occasionally one advisory that genuinely affects a path you run, with the fix version and whether it will hurt.

The measure is whether anyone reads it. If the report is longer than three items most days, the exposure filter is not being applied and you are back to a feed.