[jayfk]

Where does package vulnerability data come from? Are you using your own database?

[eslamsalem]

Yes, We use our own database. The data comes from Public disclosure vulnerabilities as well some of privately reported vulnerabilities from internal sources.