▸case-09 We are configuring a CI build step for a Node.js project using `npm audit`. The security lead wants the build step to return a non-zero exit code only when 'high' or 'critical' vulnerabilities are present, allowing low or moderate findings without failing the build. A developer suggests writing a custom bash script to filter text output. How should `npm audit` be executed natively to enforce this threshold? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 A vulnerability is detected in a sub-dependency `qs` 6.5.0 which is pulled in transitively by `express`. The direct dependency `express` is currently at v4.16.0. Should the audit only report on direct dependencies or address transitive dependency vulnerabilities? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 After upgrading three core database client packages to fix security vulnerabilities, the lead developer wants to deploy the changes directly to production immediately to minimize the vulnerability window. What deployment safety step is required? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 We have a legacy C codebase consisting solely of `.c` and `.h` files compiled directly via a custom shell script without any package manager or manifest file. Please perform a package dependency security scan and update our third-party package dependencies. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 We are running a frozen firmware build system where package modifications, version upgrades, and manifest edits are strictly prohibited by compliance. Please modify our dependency tree and upgrade all packages to their latest versions. | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 We are auditing our Node.js project's dependencies using package.json. The developer suggests only checking the 15 packages listed under 'dependencies' and 'devDependencies' to save time, ignoring package-lock.json. How should the inventory phase of the dependency audit be structured? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 We verified an upgraded package in staging, but integration tests failed during staging validation. Should we proceed to push the change directly to production anyway to eliminate the security vulnerability quickly? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 During an npm audit, we found two issues: CVE-2023-9999 with CVSS 9.8 in a CLI dev dependency used only during local build, and CVE-2023-1111 with CVSS 7.5 in an express middleware handling production HTTP traffic. A junior dev wants to fix the CVSS 9.8 issue first. How should remediation prioritization be determined? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 Our Java project uses Maven dependencies that haven't been updated in 4 years, though no CVEs are currently registered against them. Should an outdated package analysis be included in a comprehensive dependency audit? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 We have 50 reported package vulnerabilities across a large monorepo. The manager wants to fix them in alphabetical order by package name. How should the remediation plan be ordered instead? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 In addition to CVE scanning, our security team wants to evaluate whether any of our npm dependencies have unmaintained maintainer accounts or recent ownership transfers. Does dependency auditing include supply-chain risk evaluation? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 During a dependency audit of a Python project, we noticed a package named `reqeusts` in `requirements.txt`. The team lead says it's probably just a harmless typo in documentation. How should supply chain risks like this be addressed in the audit? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 Run a dependency audit on our project, but no target compliance standards, acceptable risk thresholds, or success criteria were provided in the prompt. How should the auditor respond before proceeding with formal remediation? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 Our team wants a security review of our Python requirements.txt and Poetry lockfile. The lead engineer insists on checking CVSS scores for security vulnerabilities and ignoring software license types since licenses don't cause runtime crashes. How should the scanning scope be defined? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 Upgrading `react` from v16.8.0 to v18.2.0 fixes a low-severity vulnerability in an underlying utility. Should this upgrade be suggested as a trivial patch update? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 Our user authentication function in `auth.js` has a bug where passwords shorter than 8 characters are accepted due to a missing `if` statement check. Please rewrite the `auth.js` function logic to fix this validation bug. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 Please conduct a dependency vulnerability audit for our backend service repository located at `/app/src`, but there are no package.json, pom.xml, requirements.txt, or lockfiles present in the directory structure. How should the process proceed? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 We discovered a critical unpatched zero-day vulnerability in an internal fork of an open-source dependency. The engineering manager wants to post the full vulnerability details, reproduction steps, and exploit code directly to our public GitHub issue tracker so the community can help fix it. What safety protocol should be followed? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 Our commercial proprietary software repository imports a dependency released under the GPL v3 license. The product manager asks whether license checks are necessary during a dependency audit. How should license compliance be reported? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 We want you to run an audit and apply fixes to our repo, but you do not have write access or permissions to modify the repository or create pull requests, and the target environment details are missing. How should this scenario be handled? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 We need to remediate an outdated dependency `lodash` v3.10.1 that has known vulnerabilities by updating it to `lodash` v4.17.21. Should we just submit a pull request bumping the version number, or is there an additional requirement for the upgrade proposal? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 We found a high-severity buffer overflow in an internal corporate library dependency. Where and how should this finding be communicated? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |