Unfortunately this is rarely true in practice. There is always some degree of friction or error that ought to be managed; ignoring it is how shadow IT proliferates, e.g. a dev is tired of their builds failing due to a false positive and decides to circumvent artifactory altogether.

You're spot-on otherwise.

It seems that Microsoft has built an internal tool that runs such a scan on NuGet (https://devblogs.microsoft.com/nuget/how-to-scan-nuget-packa...), at least against your individual app's packages. (That would be a very rare h/t to Microsoft from me.)

EDIT: Apparently, you can also do this with npm packages (https://docs.npmjs.com/auditing-package-dependencies-for-sec...). I don't see any facility to do this with Ruby gems.

It looks like the common practice would be to outsource the issue database to GitHub, and let whatever scanner you're using cross-reference that list?

What happens when it finds a reported problem? Does it automatically delete that mirrored package, and/or block it from being downloaded or used from the on-prem repo?

This is all new to me, and has helped put this in context, but what actual software are you talking about using for analysis?

EDIT EDIT: Running `yarn audit` in my main Rails app (just using webpacker to bundle the JS):

    97 vulnerabilities found - Packages audited: 1074
    Severity: 2 Low | 34 Moderate | 52 High | 9 Critical