# How osv-scanner Reduces False Positives in Vulnerability Analysis > Discover how osv-scanner minimizes false positives in vulnerability analysis with precise parsing, strict version matching, configurable filters, and OSV validation. Get accurate results. - Repository: [Google/osv-scanner](https://github.com/google/osv-scanner) - Tags: internals - Published: 2026-04-25 --- **osv-scanner minimizes false positives by combining precise lockfile parsing, strict version-range matching, configurable exclusion filters, and OSV schema validation to ensure only demonstrably exploitable vulnerabilities are reported.** The `google/osv-scanner` project addresses the industry-wide challenge of noisy security alerts by implementing a disciplined matching pipeline that correlates discovered dependencies with verified Open Source Vulnerabilities (OSV) database entries. By extracting exact package versions from lockfiles and validating them against precise semantic version ranges, the tool significantly reduces false positives in vulnerability analysis while maintaining high detection accuracy for real threats. ## Precise Ecosystem and Package Identification **osv-scanner** eliminates ambiguous matches by parsing language-specific lockfiles—such as `go.sum`, [`package-lock.json`](https://github.com/google/osv-scanner/blob/main/package-lock.json), and `Gemfile.lock`—to extract the exact package name and resolved version used in the build. The tool queries the OSV database using specific ecosystem identifiers (e.g., `Go`, `npm`, `RubyGems`) via [`internal/identifiers/identifiers.go`](https://github.com/google/osv-scanner/blob/main/internal/identifiers/identifiers.go), ensuring vulnerabilities from similarly named packages in different ecosystems are never considered. This precision prevents false matches where a vulnerability might affect a Python package but not its JavaScript port with an identical name. ## Semver-Based Version Range Validation OSV records store affected versions as semantic version ranges. The scanner uses the `github.com/google/osv-scanner/internal/semver` implementation to test whether your resolved version falls within any declared vulnerable ranges. In [`internal/utility/vulns/vulnerability.go`](https://github.com/google/osv-scanner/blob/main/internal/utility/vulns/vulnerability.go), the scanner parses OSV JSON entries and validates that the detected version actually intersects with the vulnerability window. If a CVE only impacts versions `v1.0.0-v1.2.0` and your project uses `v1.3.0`, the match is rejected immediately, preventing spurious alerts for already-patched dependencies. ## Configurable Exclusion Filters Development dependencies and vendored code often trigger unnecessary alerts. The scanner supports exclusion rules via the `--exclude` flag or configuration files like [`.osv-scanner.yaml`](https://github.com/google/osv-scanner/blob/main/.osv-scanner.yaml). The filtering logic resides in [`pkg/osvscanner/filter.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/filter.go), which drops any finding matching an exclusion rule before reporting. This allows teams to silence known false-positive libraries—such as test harnesses or internal tools—without losing coverage for production code. ```bash # Exclude a known false-positive test library osv-scanner -r . --exclude github.com/example/testlib ``` ## Severity-Based Thresholds Teams can configure **severity-based pruning** to hide low-impact findings. The scanner derives severity from the OSV record's `severity` field or CVSS scores when available, then filters output based on the `--severity-threshold` parameter defined in [`cmd/osv-scanner/main.go`](https://github.com/google/osv-scanner/blob/main/cmd/osv-scanner/main.go). ```bash # Only report medium severity and above osv-scanner -r . --severity-threshold medium ``` This ensures developers focus on high-impact vulnerabilities while suppressing noise from minor issues that pose minimal risk. ## Cross-Ecosystem Deduplication When the same underlying vulnerability affects multiple ecosystems—such as a Java library with an equivalent Go module—**osv-scanner** groups these findings together and emits a single entry. This deduplication prevents the same CVE from inflating your vulnerability count across different package manager ecosystems. ## Container Image Provenance For container scanning, **osv-scanner** extracts precise package manager metadata from image layers via [`internal/imagehelpers/imagehelpers.go`](https://github.com/google/osv-scanner/blob/main/internal/imagehelpers/imagehelpers.go). The tool correlates this provenance data with OSV entries and attaches metadata to each finding, as reflected in [`internal/reporter/sarif_reporter.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/sarif_reporter.go). This provenance verification guarantees that reported vulnerabilities truly exist in the scanned artifact rather than similar-named packages that might be present in the base image but unused by your application. ## Strict OSV Schema Validation All API responses undergo strict validation against the official OSV JSON schema in `internal/utility/vulns`. Malformed or ambiguous entries are discarded before processing, preventing corrupt upstream data from generating bogus matches. ## Practical Configuration Examples Combine these techniques using the CLI interface defined in [`cmd/osv-scanner/main.go`](https://github.com/google/osv-scanner/blob/main/cmd/osv-scanner/main.go) to create a tight "lockfile → version → OSV range" pipeline: ```bash # Basic recursive scan with minimal false positives osv-scanner -r . # Scan with exclusions and severity threshold osv-scanner -r . --exclude github.com/test/lib --severity-threshold medium # Container image scanning with provenance data osv-scanner image myregistry/app:1.2.3 # Use configuration file for complex exclusion rules osv-scanner -c .osv-scanner.yaml -r . ``` ## Summary - **Precise identification**: Extracts exact package names and versions from lockfiles to avoid cross-ecosystem confusion. - **Version validation**: Uses `internal/semver` to confirm vulnerabilities affect your specific version range. - **Configurable filters**: [`pkg/osvscanner/filter.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/filter.go) implements exclusion rules and severity thresholds to silence noise. - **Provenance verification**: [`internal/imagehelpers/imagehelpers.go`](https://github.com/google/osv-scanner/blob/main/internal/imagehelpers/imagehelpers.go) validates container packages against actual layer metadata. - **Data integrity**: `internal/utility/vulns` validates OSV schema to prevent malformed data from triggering false alerts. ## Frequently Asked Questions ### How does osv-scanner determine if a specific version is vulnerable? The scanner uses the `internal/semver` package to compare your resolved version against the semantic version ranges defined in OSV records. If your version falls outside the affected range, the tool rejects the match, ensuring only demonstrably vulnerable dependencies are reported. ### Can I exclude test dependencies from osv-scanner results? Yes. Use the `--exclude` flag to specify packages by name, or define exclusion rules in an [`.osv-scanner.yaml`](https://github.com/google/osv-scanner/blob/main/.osv-scanner.yaml) configuration file. The filtering logic in [`pkg/osvscanner/filter.go`](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/filter.go) removes matching findings before they appear in the final report, effectively silencing development-only false positives. ### How does container image scanning reduce false positives? When scanning container images, [`internal/imagehelpers/imagehelpers.go`](https://github.com/google/osv-scanner/blob/main/internal/imagehelpers/imagehelpers.go) extracts exact package manager metadata from specific image layers. By correlating this provenance data with OSV entries and attaching it to findings via [`internal/reporter/sarif_reporter.go`](https://github.com/google/osv-scanner/blob/main/internal/reporter/sarif_reporter.go), the scanner verifies that vulnerabilities exist in your actual artifact rather than similarly named packages in the base image. ### What prevents malformed OSV data from generating false alerts? All responses from the OSV API are validated against the official OSV JSON schema in `internal/utility/vulns`. Entries that fail schema validation or contain ambiguous version ranges are discarded, ensuring only well-formed, accurate vulnerability data influences your scan results.