A Security Tool Should Patch Its Own Dependencies First

TheAuditor tells you when a package in your project carries a known advisory. That puts a plain obligation on us: the packages inside TheAuditor have to meet the same bar, and we have to be able to show it. A security tool with a vulnerable dependency is not a hypocrisy problem. It is a vulnerability on every machine that runs it.

So before the release build exists, its supply chain gets the treatment we would want a vendor to give ours.

Every package pinned, by hash

The release build installs from a lock file, not from whatever the package index serves that day. Every package in it is pinned to one version and to the hashes of the exact files that version published, and the install refuses a file whose hash does not match. A package that changes under the same version number does not get in.

New versions wait before they can enter the lock. A release has to be 14 days old first, which gives the wider ecosystem time to notice a compromised or broken upload before we ship it. The one exception is a security fix, taken by a deliberate decision rather than by default.

Vetted against public advisories

The lock is checked against the OSV advisory database, and every pinned hash is checked against the package index’s own published digests. Two findings from that vetting moved pins in October:

• The SQL parsing library was raised to a version that closes ten advisories, three of them high-severity denial-of-service issues on untrusted SQL.
• The GraphQL library moved to 3.2.12, a patch release on the same line that fixes two high-severity denial-of-service advisories (GHSA-r77w-qph3-7vf8 and GHSA-vj8h-fx38-h3vc).

A certificate advisory, fixed in eight days

On 2026-10-20 a critical advisory was published against certifi, the certificate store the Linux build of TheAuditor bundles (GHSA-6q48-6c7w-9gw2). The keys of several eMudhra intermediate certificate authorities were recoverable, so anyone could mint a certificate that the affected store would trust. The incident’s CVE is CVE-2026-111943; certifi tracks it as the GHSA above.

The fixed store, certifi 2026.10.23, entered the release lock on 2026-10-28. Every fixed version was younger than the 14-day wait, so this was the exception the rule exists for. The fix was in place before the release build was produced. The Windows build uses the Windows certificate store.

Licenses that match what ships

Supply chain is also licensing. The tool that writes our bill of materials pulled in chardet, an LGPL library, and a development build compiled it into the binary. It is now kept out of every compiled build, and a build that contains it stops. Every release archive carries the license texts of the third-party components it bundles.

A list of what it talks to

Each release archive carries a software bill of materials, and its services section lists every network service TheAuditor or its bundled tools contact. The checksum file for each download is signed, so you can confirm the archive you have is the one we published. We touched on both in The First Hour Is Part of the Product.

Honest scope note

A clean advisory check is a statement about known advisories on the day it ran. It is not a promise that no unknown flaw exists in any dependency. What we can show is the process: pinned by hash, checked against public advisories, and, as this month showed, a critical fix taken within days of it landing rather than at the next convenient release.

Where this sits

Trust in a closed-source scanner starts with the parts you can check, the theme of Can You Trust a Closed-Source Security Scanner? That is the ground-truth discipline behind Code Reality Labs, applied to our own build. TheAuditor is in final commercial release preparation and ships when its hardening checks pass. Subscribe on the main site for launch news.