Preprint
Sep 2026
Never Emitted: Reporter Attribution in GitHub's Machine-Readable Vulnerability Records
It is shown that the NVD API schema defines no credits field, so attribution that CNAs do emit does not reach the database most tooling consumes: of 43 credit-bearing records traced from advisory to CVE record to NVD, none retained it.
A. M. Syed
· 0 citations