OSV is a distributed database and aggregator of open-source security advisories that uses a standardized vulnerability schema to track security flaws. It functions as a system for collecting and normalizing security data from diverse ecosystems into a single unified format, providing a web API for querying package vulnerabilities and submitting standardized records.
The project distinguishes itself through a security advisory distribution service that supports bulk dataset exports via cloud storage buckets and incremental synchronization of security record updates. It also employs sandbox-based impact analysis, using version bisections in isolated containers to determine the exact range of affected software versions.
The system provides capabilities for software dependency scanning, allowing users to identify known flaws by mapping project versions and commit hashes against the vulnerability database. It includes tools for batch package querying, library version identification, and vulnerability record validation to ensure data integrity.
The project also provides auditing utilities to identify and report ingestion failures and data integrity issues during the import process.