Liability Index

What is the Liability Index? #?

The Liability Index is a single value that determines how much security liability exists in an application. Measuring this metric will help your team keep your software systems safe by ensuring that known vulnerabilities are fixed quickly. Technically speaking, the Liability Index is a dependency freshness measurement that computes how long your dependencies have had published, yet patchable, security vulnerabilities.

Why does the Liability Index matter? #?

Most modern software systems depend on many different libraries. These libraries provide a ton of useful functionality that a software development team does not have to build themselves. However, this functionality does come at a cost: commonly used libraries are an attack vector for people looking to exploit security vulnerabilities.

How do you compute the Liability Index? #?

The Liability Index can be computed for either an entire project or for just a single dependency. Single Dependency # To compute the value for a single dependency, first determine the date that the current version was published, we’ll call this the published date. Next determine whether or not this version has a known security vulnerability.