CFLite and OSV

[evverx]

It's more of a question than a feature request. I'm considering moving some projects from OSS-Fuzz to CFLite and I wonder whether it's safe to assume that CFLite won't be integrated with https://osv.dev/ by sharing its results with the database or anything like that?

[jonathanmetzman]

I don't have any plans to do this, but I can't say for sure it won't ever happen.
Why stop oss-fuzz, is it because of OSV?

[evverx]

I don't have any plans to do this, but I can't say for sure it won't ever happen.

Good to know. Thanks!

Why stop oss-fuzz, is it because of OSV?

As far as I understand its API is used by bash scripts or something like that to automatically assign CVEs without vetting them much. I think I mentioned that at least twice last year somewhere but it just keeps happening and it appears it won't change in the foreseeable future (given that the API is open and isn't covered by any terms of use apart from the standard ones).