I ran into an issue while correcting a GitHub security advisory: the package name was fixed, but the edited record lost its CVSS severity metadata.

So I built AdvisoryGuard, a small open-source TypeScript CLI that validates OSV JSON and compares advisory records before and after an edit.

It flags removed CVSS entries, changed affected-version ranges, missing references, and other metadata changes worth reviewing.

It works offline, never modifies your files, and requires no API keys.

npx advisoryguard diff before.json after.json

The README includes an animated demo using the real CLI.

GitHub: https://github.com/zuhairhalawa/AdvisoryGuard

Feedback on edge cases or advisory formats would be particularly useful.

showdev #opensource #security #typescript