Contributing to ACVE

Contributing to ACVE

ACVE is a public, PR-based advisory registry. Keep one advisory per pull request so the evidence, matcher, fixtures, and review decision stay together.

File an advisory

1. Run acve advisory new --summary "…" --alias CVE-YYYY-NNNN --ecosystem <ecosystem> --package <package> --class <vuln-class> --apply.
2. Fill the generated record, including structured affected ranges, references, matcher, severity, and typed fix actions.
3. Run acve advisory validate --strict.
4. Run acve advisory ground <id> --allow-network --apply when the record has a CVE/GHSA or package grounding path.
5. Add test/fixtures/locks/<id>.vulnerable.json and .safe.json, plus the seed test row proving the matcher is true and false respectively.
6. Open one PR for the advisory and its tests.

Do not put secrets, exploit code, or private configuration values in a lock fixture. The lock format is designed to be safe to share by recording hashes, names, scopes, and tokenised arguments.

Reviewer checklist

• The id is unique, matches the filename, and uses the advisory year.
• Every alias resolves on NVD or GHSA, or an ACVE-native noCveReason explains why there is no alias.
• Affected ranges are structured and match the vendor advisory.
• The matcher uses some/where scoping and every referenced field exists in the lock schema.
• Fix actions are typed (upgrade, reconfigure, remove, or disable).
• There is no exploit code and no secret.
• The severity label is justified.
• CC-BY-4.0 advisory licensing is acknowledged.
• The vulnerable/safe fixture pair is present and the seed test covers both.

Validation means a second person reproduces the behavior or a vendor advisory confirms it. Add a validatedBy[] entry through the PR. Maintainers flip candidate to published after review and grounding. To withdraw, add status: withdrawn and a withdrawn timestamp; never delete the record.

Add a harness discovery module

Add src/lib/discover/<harness>.mjs with the existing discovery contract: export discover(ctx) and return { agents, warnings }, using ctx.io for reads, normalised lock schema fields, source hashes, and no credential paths. Add a fixture home under test/fixtures/homes/, a golden lock under test/golden/, and a test that checks redaction plus the canary credential-file guard. The module must not execute discovered commands; if probing is supported it must use the existing allowlisted, shell:false path. Add the harness to the index and verify the full suite.