Supporting Upstream Vulnerability Triage in Fork-Based Development: A Brazilian Government Experience - Damasceno, José Renan F.; Rocha, Lincoln; Rego, Paulo (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
Open-source software reuse accelerates the development of complex systems, but it also introduces software supply chain risks when downstream projects evolve independently from their upstream codebases. This challenge is particularly relevant in fork-based development, where security fixes disclosed upstream must be assessed, prioritized, and adapted under project-specific constraints. This paper reports a Brazilian government experience in monitoring upstream vulnerabilities for a secure mobile communication app derived from Matrix/Element open-source clients. We present an automated workflow that combines CPE-based queries to the National Vulnerability Database with advisory mining from the GitHub Advisory Database, enriches vulnerability records with CWE information, and extracts metadata from upstream vulnerability-fixing commits. Rather than replacing human assessment, the workflow provides structured evidence for AppSec-mediated decision-making among development, security testing, and DevSecOps teams. The experience shows how upstream vulnerability monitoring can support downstream triage, remediation planning, patch inspection, and documented downstream security assessment. Our findings highlight that vulnerability management in fork-based projects is not only a technical detection problem, but also an organizational coordination challenge involving evidence-driven, contextual analysis, and security governance.