OWASP / OWASP/cve-lite-cli

perf: CLI scan performance audit and optimization

Open
#837 1 comment 0 reactions 1 assignee View on GitHub

@sonukapoor is already working on this.

Since Jul 14, 2026.

enhancement
Dominant language
TypeScript
Stars
715
Forks
145
Avg merge
21h 39m
Merged PRs (30d)
66

Description

Overview

Profile the CLI's end-to-end scan execution time and identify the highest-impact optimizations.

Motivation

As the feature set grows (override hygiene, phantom detection, maintenance risk, SARIF output), scan time should be validated against the original fast-scan promise. This issue tracks a focused performance audit to find and fix the top bottlenecks.

Scope

  • Profile a representative scan (medium-sized project, ~500 packages, live OSV queries)
  • Identify the top 3-5 slowest paths (network I/O, parsing, fix validation, output rendering)
  • Implement targeted fixes - no speculative optimization
  • Measure before/after for each change

Candidates to investigate

  • OSV batch query efficiency
  • Packument fetch parallelism and cache hit rate
  • Lockfile parsing time on large monorepos
  • Fix validation concurrency (validateDirectFixTargets)
  • Output rendering for large finding sets

To be done in-house

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.