The builder's path
For: Security scanners can't match some OSV vulnerability records by package URL because OSV.dev has no conversion for those ecosystems.
“Some things are under our control, while others are not under our control.”
Routes to a solution
Each route is a different kind of journey, with real people and organisations to contact at each step, starting with those in every country.
Step 1
Build in the open
Publish the code and invite contributors from the community.
Let the people a free tool helps fund its maintainer directly.
Raise and spend money in the open for a community project.
Grants for open source that makes the internet better.
Network of civic tech groups in many countries; find the one near the problem.
Step 2
Fund the maintainers
Sponsors, collectives and open source grants.
Let the people a free tool helps fund its maintainer directly.
Raise and spend money in the open for a community project.
Grants for open source that makes the internet better.
Network of civic tech groups in many countries; find the one near the problem.
Step 3
Get it adopted
Civic tech groups and public bodies take it up.
Y Combinator's free course and co-founder matching.
Raise and spend money in the open for a community project.
Network of civic tech groups in many countries; find the one near the problem.
Volunteer data scientists working with social-sector organisations.
Ideas, sources and tools for this problem, from first interviews to funding.
the list of known PURL types
how records and ecosystems are structured
labelled the issue ‘good first issue’ and review data quality fixes
Starter prompt
Built from this problem's brief. Paste it into Claude or any AI assistant.
Help me design and build a first working prototype for this problem in Anywhere. Problem: Security scanners can't match some OSV vulnerability records by package URL because OSV.dev has no conversion for those ecosystems. Who it hurts: People who use OSV.dev, an open vulnerability database, with tools that identify packages by package URL (PURL). The moment it hurts: When a scan quietly misses a vulnerability because the record has no PURL to match on. What people do today: Some records have PURLs only because their upstream data source supplies them. Why it is still unsolved: Ecosystems were added to OSV.dev without matching PURL conversions, and nothing checks for the gap. What solved looks like: Each remaining ecosystem gets a PURL converter with tests using the type in the PURL spec, or is listed as having no PURL equivalent, and a test fails whenever a new ecosystem is added without either. Where: Anywhere First, list what you would need to learn from the people affected before building, as interview questions. Then propose the simplest version that would help, the screens or messages it needs, and the data it would use. Keep it cheap to run, accessible, and respectful of people's privacy. Flag anything you are unsure about instead of guessing.
Talk to the people who live it before you build.
“Arise, awake; seek out the wise and learn.”
उत्तिष्ठत जाग्रत प्राप्य वरान्निबोधत
uttiṣṭhata jāgrata prāpya varān nibodhata
Get a working version in front of people fast.
Using AI is not cheating. Every tool carries the work of the people who made it, and using it well is how knowledge has always moved forward. The thinking, the care for the people who live the problem, and the judgement are still yours.
“The Analytical Engine weaves algebraical patterns just as the Jacquard-loom weaves flowers and leaves.”
Open data that fits this problem.
“The first principle is that you must not fool yourself, and you are the easiest person to fool.”
Tools matched to what this problem needs.
“That which is an obstacle on the road helps us on this road.”
Ship it responsibly, and find help and funding.
“Give me a place to stand, and I will move the earth.”
δός μοι πᾶ στῶ καὶ τὰν γᾶν κινάσω
Kit written for this problem from its brief; every link was checked. Links go to each provider's own site. Zetema is not paid for any listing.