OSV API boundary

Evidence-backed facts

1. Google Open Source Vulnerabilities documents open-source vulnerability records, package/version queries, batch queries, affected ranges, aliases, and events. informative
2. Public reads do not grant advisory editing, package ownership, vulnerability validation, remediation, or Google authority. informative
3. Clients must bind ecosystem, package, version, commit, query batch, pagination token, schema version, and aliases. informative
4. OSV aggregates upstream advisories with varying coverage and timing; results do not prove exploitability, reachability, compromise, or absence of vulnerabilities. informative

Primary sources