[ MSP.DD ] For investors and founders · Updated
How do you assess dependency vulnerabilities in a target's codebase?
Short answer
Match every dependency and version against a vulnerability database such as OSV, then check which vulnerable code the product actually uses. In Black Duck's 2025 analysis, 86% of commercial codebases contained vulnerable open source, so finding some is normal. What matters is how many are serious, reachable and left open.
Why it matters
Every codebase has known vulnerabilities somewhere. The finding that changes a deal is a team that leaves serious ones open for months.
How to check
- 01Pull exact versions from lock files, not the version ranges in the manifest.
- 02Query a vulnerability database. OSV covers npm, PyPI and most other ecosystems.
- 03Rank by severity and by whether the vulnerable code is reachable.
- 04Check the team's history: how long do known vulnerabilities stay open?
Red flags
- Critical vulnerabilities left open for months.
- No lock files, so nobody knows exactly what's deployed.
- Dependencies years out of date.
Good signs
- Automated dependency updates.
- A patch policy with timelines that the history shows is followed.