Why does OWASP Dependency-Check produce false positives and how do you manage them?
Quick Answer
It identifies libraries by guessing their CPE (the NVD's product identifier) from filenames and metadata, and similarly named libraries collide — so it flags CVEs for a product you are not actually using.
Detailed Answer
It identifies libraries by guessing their CPE (the NVD's product identifier) from filenames and metadata, and similarly named libraries collide — so it flags CVEs for a product you are not actually using. Manage it with a version-controlled suppression file that pins each suppression to a specific CVE and dependency with a justification, keep the NVD feed fresh (an API key or local mirror avoids rate-limited stale data), and set failBuildOnCVSS to a threshold the team agreed on.
Code Example
# Deep-dive: OWASP Dependency-Check # CVE matching via the NVD feed, CPE identification and false positives, suppression files, the NVD API key and mirror for slow feed updates, CVSS-based failBuildOnCVSS thresholds, and generating SBOM-adjacent reports # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
Interview Tip
This is where depth shows — be concrete about OWASP Dependency-Check, not generic about "security".