@rhessinger Thanks for the clarification. Just to be sure - there's no linkage between the SCA Project back to the Nuget package / feed, right? The two modules are basically independent of each other

@atripp I've set up a testing app just to experiment with. It currently only exists in one feed

In this example, v2013.7.13.4 has issues associated from SCA (one vulnerability from 3 CVE and one missing package)

When I go to that version within the feed, I see no known vulnerabilities. Note we don't have any OSS Index associated with this feed since it's our internally built tools - closed source.

My thought is that the vulnerabilities listed on the Project + Version/Release level should propagate down to the package in the feed as well. Is that a fair understanding of how it should work?

We have started evaluating the SCA / SBOM function within ProGet. When using pgscan to build/load the SBOM, I see the release and project appearing in the "Reporting & SCA" section -- with a nice breakdown of all imports and associated vulnerability risk.

As it stands right now, the two locations show conflicting data:

• the SCA/Project page says that there are vulnerabilities

but

• The Package page shows that there are none (persumably since our internally built packages aren't found on any OSS listing)

Is there any way that these findings can be propagated to the actual Package/artifact within our internal feed?