# Security advisories

> Security advisories for a software vendor: products and versions with CycloneDX components, vulnerabilities enriched from OSV, EPSS and the CISA KEV catalog on a schedule, OpenVEX statements per version, and CSAF 2.0 advisories with a /.well-known/csaf handler, linked to incidents and risks through relations.

- Category: Work management
- Module: `advisories`
- Modes: `managed`, `custom`
- Docs: https://bettersupabase.com/docs/blocks/advisories
- Page: https://bettersupabase.com/blocks/advisories

## Install

```bash
npx better-supabase add advisories
```

The command also installs `updated-at`, `memberships`, `permissions`, `subjects`.

## Configure

Add the block to `better-supabase.config.ts`:

```ts
import { defineConfig } from "better-supabase/config";

export default defineConfig({
  blocks: {
    // Required by advisories; add installs them too.
    "updated-at": {},
    memberships: {},
    permissions: {},
    subjects: {},
    // Modes: "managed", "custom". The default is "managed".
    advisories: { mode: "managed" },
  },
});
```

## Client

The block has no React entry yet. Its server-side TypeScript is in `better-supabase/blocks/advisories`.

## Events

- `advisory.created`
- `advisory.published`
- `advisory.updated`
- `advisory_product.created`
- `advisory_product.updated`
- `advisory_product_version.created`
- `sbom_component.imported`
- `vex_statement.saved`
- `vulnerability.created`
- `vulnerability.enriched`
- `vulnerability.exploited`

## Related blocks

Requires: [memberships](https://bettersupabase.com/blocks/memberships.md), [permissions](https://bettersupabase.com/blocks/permissions.md), [subjects](https://bettersupabase.com/blocks/subjects.md)

Works with: [relations](https://bettersupabase.com/blocks/relations.md), [incidents](https://bettersupabase.com/blocks/incidents.md), [risks](https://bettersupabase.com/blocks/risks.md), [outbox](https://bettersupabase.com/blocks/outbox.md), [audit](https://bettersupabase.com/blocks/audit.md)