Skip to main content
Every threat report you submit goes through a multi-stage review process before it is published to the public database. This ensures that the threat feed stays accurate and that security tools consuming the API receive reliable data. Understanding how the process works helps you write reports that move through review quickly.

​
The four-stage review pipeline

1

Stage 1: Submission — "Pending"

Your report enters the review queue immediately after submission. An automated check runs to verify completeness and formatting. Based on the report type and content, the system assigns the report to an experienced community reviewer with relevant expertise.
2

Stage 2: Initial review — "In Review"

A community reviewer examines your report in detail. During this stage they:
  • Analyze the malicious code or behavior you described
  • Cross-reference findings with known vulnerabilities and threat intelligence
  • Verify that evidence links and sources are accessible and support the claim
  • Check for duplicate reports in the database
  • Assess whether the severity level you selected is appropriate
3

Stage 3: Verification — "Under Verification"

High-severity or complex reports may require additional review time beyond these estimates. You will receive a notification if your report moves into extended review.
For high-severity or complex cases, a second reviewer may validate the findings independently. This double-review step ensures accuracy for threats that could impact a large number of users or critical infrastructure.
4

Stage 4: Publication — "Verified"

Once verified, your report is published to the public OSM database. You receive points credited to your community profile, and the threat becomes available through the API for security tools and integrations to consume.

​
Review criteria

Reviewers evaluate reports against four criteria. Addressing all four in your submission gives your report the best chance of being verified on the first pass.
Strong evidence is the most important factor in a successful review. Reviewers assess whether the evidence you provided clearly demonstrates malicious intent. Links to official advisories such as OSV or GHSA entries significantly strengthen a report compared to descriptions alone.
The threat description and payload details must be technically correct. Reviewers verify that the malicious behavior is described accurately and that the severity level reflects the actual impact of the threat.
Reports should include all relevant information: affected versions, publisher details, and a comprehensive description of the threat. Incomplete reports may be returned with a request for additional information before they proceed.
Reviewers check whether a report already exists for the same threat. If a similar report is found, the reviewer may merge the information or mark the submission as a duplicate. Use the Browse Threats page before submitting to avoid this outcome.

​
Possible outcomes

After review is complete, your report will receive one of the following outcomes:
OutcomeWhat it means
VerifiedYour report is confirmed as accurate and published to the database. You receive points for the contribution.
Needs more informationReviewers require additional details or evidence. You will be notified about exactly what is needed.
ModifiedThe report is verified but required corrections — for example, a severity adjustment or additional context. Your original submission still receives attribution.
Rejected (false positive)The resource is not malicious. False positives are tracked on your profile, so careful verification before submitting is important.
DuplicateA report for this threat already exists in the database. Check the Browse Threats page before submitting to avoid this outcome.

​
Expected timeline

StepTiming
Initial automated checksImmediate
Assignment to a reviewer1–6 hours
Initial review completion6–24 hours
Final verification (if needed)24–48 hours

​
Version control and updates

Verified threats can be updated as new information becomes available. When a verified threat is modified:
  • The previous version is archived and remains accessible for reference
  • All changes are tracked with timestamps and the identity of the modifier
  • The threat status changes to Modified to indicate that updates have been applied
  • Original submitters retain full attribution for their discovery

​
Who reviews reports

Reports are reviewed by trusted community members who have demonstrated expertise in security research:
  • Security researchers with proven track records
  • Contributors with a history of high-quality submissions
  • Platform moderators and administrators
  • Domain experts in specific ecosystems such as npm, PyPI, or container registries
Want to become a reviewer? Build your reputation by submitting accurate, well-evidenced reports. Experienced contributors with strong track records may be invited to join the review team.